Perhaps a staff member who knew the login has left. Perhaps your browser has warned that the password appeared in a data breach, or you have finally admitted that the same password protects your website, your email and your bank. Whatever the reason, it is a good moment to change your WordPress password, and it takes a couple of minutes when you can still log in.
Everything below assumes you can still reach the dashboard. If you cannot log in at all, jump to the last section before the questions, which points you to the right guide.
First, make sure it is the right password
Business owners often have four or five passwords connected to one website, and they are not interchangeable. Changing one does not change the others.
- Your WordPress login, used at /wp-admin/ or /wp-login.php. This post is about this one.
- Your hosting account, for the control panel where the site’s files and databases live.
- FTP or SFTP accounts, used by developers to reach the files directly.
- The database password, stored in the site’s wp-config.php file. Never change it in the hosting panel without updating that file, or the site goes offline.
- Your email account, which matters because password reset links for WordPress are sent there.
If someone you no longer trust may know several of these, change all of them, starting with email and hosting. For WordPress itself, read on.
How to change your WordPress password
- Log in and open Users → Profile (people with lower roles just see Profile in the left menu). Another way in is to click your name at the top right of the screen and choose Edit Profile.
- Scroll down to Account Management.
- Click Set New Password. WordPress fills in a long, random password and shows a strength meter beside it.
- Either keep the generated password or replace it with one of your own. If you keep it, copy it into your password manager now, before you go any further.
- Save with the Update Profile button at the foot of the page.
You stay logged in on the browser you are using. WordPress also sends a short “Password Changed” email to the address on your profile. If you ever receive that email without having changed anything, treat it as a warning and act straight away.
When WordPress complains about a weak password
If you type your own password and the meter says Weak or Very weak, WordPress shows a Confirm use of weak password checkbox and will not save until you tick it. Do not tick it on an administrator account. Make the password longer instead. A string of four or five unrelated words is easier to remember than a jumble of symbols and is generally stronger, as long as you do not use it anywhere else.
Use a password manager
The generated passwords are good precisely because nobody could remember them. A password manager, whether the one built into your browser or a dedicated app, stores them and fills them in for you. It also stops you reusing the same password on several sites, which is how most stolen logins are used against other accounts.
Changing a password for another user
Administrators can manage other accounts from Users → All Users. Hover over the person’s name, click Edit and scroll to Account Management. There are two choices:
- Send Reset Link emails the user a link to choose a new password themselves. Their current password keeps working until they use the link. This is the polite option for a colleague.
- Set New Password changes it immediately. Use this when the account must stop working with the old password now, for example after someone leaves or a password has been shared too widely. Click Update User to save.
If the person has left the business for good, a new password is only half the job. Our overview of the WordPress dashboard shows where the Users screen sits, and the checklist for when an employee leaves covers the accounts outside WordPress too.
Logging out other browsers and devices
WordPress links each login to your password, so after you change it, logins on other computers and phones normally stop working and those devices have to sign in again. It is still worth knowing the button that does this on purpose.
On the same Profile screen, below the password, there is a Sessions row. If you are logged in anywhere else, the button Log Out Everywhere Else is active. Click it and every other session ends, while you stay logged in where you are. If the button is greyed out, WordPress believes you are only logged in at your current location.
Administrators editing another user see a similar option to log that person out of all locations. More detail on reviewing and ending sessions across a team is in our post on logging out every WordPress session.
What a password change does not cover
- Application passwords. If your account has application passwords, used by apps and integrations to connect to the site, they keep working after you change the main password. Revoke them separately, lower on the same Profile screen. Our guide to WordPress application passwords explains what they are for.
- Other administrator accounts. Changing your own password does nothing about an old developer account or a shared “admin” login. Review the full list under Users and ask whether each account still needs to exist.
- Two-factor authentication. A strong password is the base; a second step at login adds a lot on top. If your site does not have it, see adding two-factor authentication to WordPress.
These jobs, and the rest of looking after the site week to week, are gathered in our guide to managing your WordPress site.
If you cannot log in to change it
Everything above assumes you are inside the dashboard. If you have forgotten the password, or the login page rejects it, use the “Lost your password?” link under the login form, which emails you a reset link. When that email never arrives, or you have no working administrator account at all, follow our step-by-step guide to resetting a WordPress password, which covers the hosting-panel route too.
Frequently asked questions
How often should I change my WordPress password?
There is no need to change a long, unique password on a fixed schedule. Change it when there is a reason: someone who knew it has left, it was shared by email or chat, it appeared in a breach warning, or you used it on another site. A strong password you never reuse matters more than frequent changes.
Will changing my password break my contact forms or plugins?
No. Forms, plugins and your theme do not use your personal login password. The only things that might stop working are apps where you typed that password directly, such as an old mobile app connection. Integrations set up with application passwords or API keys carry on as before.
Can I see my current WordPress password?
No. WordPress stores only a scrambled version of each password, so nobody, including an administrator or your host, can look up what it is. If you have forgotten it, the only option is to set a new one, either from your profile while logged in or through the reset link on the login page.
Should everyone on my team share one admin login?
It is better to give each person their own account with the role they need. Shared logins make it impossible to see who changed what, and when one person leaves you have to change the password for everyone. Separate accounts can be removed one at a time without disturbing the rest of the team.
Sometimes the reason for a new password is a feeling that something is off: a user nobody recognises, a setting that changed by itself. A password alone may not settle that. Going through the accounts and recent changes with someone else is one of the things our WordPress support service is for.
Next in this series: Export WordPress Content: What the File Includes
