To change your WordPress password, log in to your admin dashboard, go to Users → Profile, scroll to Account Management, click Set New Password, and save your profile. That’s the gist.
People often search for information like this in urgent situations, whether a staff member has left, a contractor has completed a project, a breach alert has appeared in your inbox, or you have realised you have been using the same password since the site launched in 2019.
When Should You Change Your WordPress Password?
Change your WordPress password immediately when any of the following apply.
- You suspect or have evidence of a breach
- A staff member with admin access leaves the business
- A contractor or freelancer with site access has finished up
- You’ve logged in from a shared or public computer
- You’ve spotted unfamiliar logins or unexpected admin users
- Your hosting provider or a major plugin has reported a breach
- Your password appears in a known data breach (check Have I Been Pwned)
- You’re still using the password you set up when the site was first built
You may have heard an old piece of advice to change passwords every 30, 60 or 90 days. Security researchers have moved away from that. Forced rotations tend to push people into predictable patterns like “Password1, Password2, Password3” or small tweaks to the same base word. The result is weaker passwords, not stronger ones.
How to Change Your Password From Inside WordPress
Use this method when you’re already logged in and just want to update your password.
Step 1: Log In to Your WordPress Admin
Head to yourwebsite.com/wp-admin and log in with your current details. You’ll land on the dashboard.
[SCREENSHOT: WordPress admin dashboard with the user menu visible in the top right]
Step 2: Open Your Profile
Hover over your username in the top right corner of the dashboard. A dropdown will appear. Click Edit My Profile.
You can also get there from the left-hand menu by clicking Users, then Profile.
Step 3: Scroll to Account Management
The profile page is long. Scroll down past your name, contact info and the colour scheme options. You’re looking for the Account Management section, which sits near the bottom of the page.
[SCREENSHOT: Account Management section showing the Generate Password button]
Step 4: Generate a New Password
Click the Set New Password button. WordPress will automatically generate a strong password for you and display it in a text field.
You have two choices here. Use the one WordPress gave you, which will be long, random and genuinely secure. Or overwrite it with your own. If you go your own way, WordPress will show a coloured strength indicator. Don’t save anything that shows up as Weak or Medium.
If the password reads as Weak, lengthen it. Length beats complexity. A 16-character passphrase is harder to crack than an 8-character string of symbols.
Step 5: Save the Password Somewhere Safe
Before you save the change in WordPress, copy the password into a password manager like Bitwarden, 1Password, or Dashlane. Don’t email it to yourself or write it on a sticky note. Never save it in a Word doc called “passwords.docx” on your desktop.
If you’re not using a password manager yet, this is the moment to start. A good one costs less than a coffee a month and removes the entire problem of remembering or losing logins.
Step 6: Click Update Profile
Scroll to the bottom of the page and click Update Profile. WordPress will log you out of any other active sessions, which is exactly what you want. Anyone using your old credentials elsewhere is now booted out.
How to Reset Your Password When You’re Locked Out
Use this method when you can’t remember your password and can’t log in.
Step 1: Go to the Login Screen
Navigate to yourwebsite.com/wp-admin or yourwebsite.com/wp-login.php. Both go to the same place.
Step 2: Click “Lost Your Password?”
Below the login fields, you’ll see a link that reads Lost your password? Click it.
Step 3: Enter Your Username or Email
You can use either. If you’ve got more than one account on the site, your email is the safer bet.
Click Get New Password.
Step 4: Check Your Email
WordPress will send a password reset email to the address attached to your account. It usually arrives within a minute or two. If it doesn’t, check spam, then check your junk folder.
The email contains a unique reset link that expires after 24 hours. Click it.
Step 5: Set Your New Password
The link opens a page where you can enter a new password. WordPress will suggest a strong one. As with Method 1, use the suggestion or replace it with your own. Either way, make sure it scores Strong.
Save it in your password manager before you confirm.
Step 6: Click Reset Password
Click the button, and you’ll be sent back to the login screen. Log in with your new credentials.
What If You Don’t Receive the Reset Email?
A surprisingly common problem. If the reset email doesn’t arrive, work through these in order.
Check your spam folder. Reset emails often land there, especially from WordPress sites with default email settings.
Confirm the email address on the account. If you’ve changed your email recently and the account still points at the old one, the reset won’t reach you.
Ask your web host. Many WordPress sites send mail through the server’s default mail function, which is unreliable. A good host can confirm whether the email was sent and where it went.
Use phpMyAdmin. This is the technical option. If you have hosting cPanel access, you can reset the password directly in the database. It works, but it’s easy to break things if you’re not careful. If you’re not comfortable doing this, ask your developer or your support partner. This is the kind of thing our WordPress support team sorts out for clients regularly.
Install a recovery plugin via FTP. Emergency Password Reset is a free plugin that does what the name suggests. You upload it via FTP, activate it, and use it to reset the admin password. Then delete it. Again, not for everyone, but it works.
If you’re getting locked out repeatedly, something is wrong. That’s a separate issue, and worth investigating.
What Makes a WordPress Password Strong Enough?
A strong WordPress password is long, unique, and unpredictable.
Long means length is doing most of the work. Every extra character multiplies the time it takes a computer to guess. A 15-character password takes orders of magnitude longer to crack than an 8-character one, even if the shorter one looks more complex.
Unique means you don’t use it anywhere else. If another site you’ve signed up to gets breached, the attacker doesn’t get a free pass into your WordPress site, too.
Unpredictable means it’s not based on anything someone could guess from looking at you or your business. Avoid the following:
- Your business name, your name, or your dog’s name
- Years, birthdays, or your phone number
- Single dictionary words, even with numbers tacked on
- Sentences or common phrases (attackers test these too)
- Anything you’ve used on another site
- Default passwords your developer set up at launch
How to Stop People Brute-Forcing Your WordPress Login
These four practices prevent brute-force login.
Limit Login Attempts
Plugins like Limit Login Attempts Reloaded block users after a set number of failed tries. By default, WordPress allows unlimited attempts, which is generous of it. Cap it at three or five.
Turn On Two-Factor Authentication
Two-factor authentication (2FA) adds a second step to login, usually a code from an app like Google Authenticator or Authy. Even if someone has your password, they can’t get in without your phone.
Free plugins like Wordfence, Two Factor Authentication, and miniOrange all handle this well. Set it up once, and you’re protected.
Change Your Username From “admin”
If your WordPress admin account is still called “admin”, change it. Every brute-force script in existence tries that username first. Use something specific to you and harder to guess.
You can’t change a WordPress username from inside the dashboard, but you can create a new admin account, transfer your posts to it, and delete the old one.
Hide the WP-Admin URL
Plugins like WPS Hide Login let you change the login URL from /wp-admin to anything you want. It’s not a substitute for a strong password, but it cuts down on automated attacks aimed at the default URL.
Keep WordPress, Plugins and Themes Updated
Most successful WordPress hacks aren’t password-related. They’re plugin or core vulnerabilities that have been patched but not installed. Stay current. We’ve written more on this in our piece on how to secure your WordPress website.
How Often Should You Audit Your WordPress Users?
Every three months is a sensible cadence. Open the Users section in your WordPress admin and ask three questions of every account on the list.
Does this person still need access? If they’ve left the business, finished a project, or just don’t log in any more, delete them.
Do they have the right role? Editors don’t need Administrator access. Contributors don’t need Editor access. Match the role to the actual job.
Has this account been used recently? If an account hasn’t logged in for six months, it’s a candidate for deletion. Dormant accounts with admin rights are a soft target.
A clean user list is one of the easiest security improvements you can make. It costs nothing and takes ten minutes.
A Quick Word on Password Managers
A password manager generates strong, unique passwords for every site you use, stores them encrypted, and fills them in automatically. You only have to remember one master password. That’s it. No more sticky notes, no more “Password123!”, no more reusing the same login across ten different services.
Bitwarden has a free tier that covers most small business needs. 1Password and Dashlane have polished paid plans. Any of them is better than what most people are doing now.
For a business with multiple staff accessing WordPress, a team plan lets you share passwords securely without ever revealing them. Useful when you’d rather not text the WordPress login to your bookkeeper.
Keep It Simple, Keep It Updated
Changing your WordPress password is one of those small admin tasks that quietly does a lot of work. When there’s a reason to do it, it takes you five minutes. It protects your site, your customers and your reputation.
Pair it with two-factor authentication, a clean user list and a password manager, and you’ve covered the basics that stop almost every real-world WordPress attack.
If you’re not sure your site is set up safely, or you’d rather hand the whole thing over and stop thinking about it, we can help.
Talk to us about WordPress support.
