- Article
- 2 minutes read
- Reviewed August 4, 2026
Account security protects the identities used to administer, publish and integrate with WordPress.
A fully updated website can still be compromised through a stolen administrator password or email account.
Use Strong Unique Passwords
Every account should use a password that is:
- Long.
- Unique to the service.
- Random or generated.
- Stored in a trusted password manager.
- Never shared through chat or email.
Reusing passwords allows credential-stuffing attacks after another service is breached.
Protect the Recovery Email
Password-reset messages are sent through email.
Protect the associated mailbox with its own unique password, multi-factor authentication and recovery controls. Remove access for former staff and suppliers.
Avoid Shared Accounts
Each person should have an individual WordPress user.
Individual identities support least privilege, logs, session control and reliable offboarding.
Shared administrator credentials make accountability and revocation difficult.
Review Sessions
WordPress can invalidate other sessions from a user profile.
Review sessions after:
- A lost device.
- Staff departure.
- Suspected phishing.
- Password reset.
- Privilege change.
- Security incident.
Account Lifecycle
Define how accounts are:
- Requested.
- Approved.
- Assigned roles.
- Reviewed.
- Suspended.
- Deleted or anonymized.
- Restored.
Remove privileges promptly when responsibilities change.
Application Credentials
Do not give integrations a user’s primary password.
Use revocable application passwords, OAuth, service accounts or another supported authentication method appropriate to the integration.
Usernames and Enumeration
A secret username is not a reliable security control.
WordPress can expose author information through public content and APIs. Protect accounts through passwords, 2FA, rate limits and permissions.
Frequently Asked Questions
Should passwords be changed on a fixed schedule?
Change them when compromise is suspected, access changes or policy requires it. Strong unique passwords and 2FA are more important than predictable forced rotation.
Is the administrator username admin unsafe?
A different username can reduce trivial guessing, but it is not a substitute for strong authentication.
Continue Learning
Previous: [Choosing Trusted Themes and Plugins](/resources/wordpress-manual/security/choosing-trusted-themes-plugins/)
Next: [Two-Factor Authentication in WordPress](/resources/wordpress-manual/security/two-factor-authentication/)