How to Change Your WordPress Admin Password Safely (4 Ways)

Your WordPress admin password is the master key to your entire website — content, customers, income, all of it. Changing it is something you should do after hiring or parting with a developer, after any hint of suspicious activity, or simply as periodic hygiene. The trick is doing it without locking yourself out, which frightens people into never doing it at all. Every method below is safe and reversible, and at least one works even if you’ve forgotten the password completely.

This guide covers all four ways to change a WordPress admin password — from the dashboard, from the login screen, via your database, and via WP-CLI — plus how to make the new password actually strong.

Quick Answer

To change your WordPress admin password safely: if you’re logged in, go to Users → Profile, scroll to Account Management, click “Set New Password”, let WordPress generate a strong one, save it in a password manager, and click Update Profile. If you’re locked out, use the “Lost your password?” link on the login page to reset by email. In emergencies, you can reset it directly in the database via phpMyAdmin (MD5 hash in the wp_users table) or with WP-CLI. Never reuse the password anywhere else, and turn on two-factor authentication afterwards.

Method 1: From the Dashboard (You’re Logged In)

1. Go to Users → Profile in the WordPress dashboard.
2. Scroll to Account Management → New Password and click Set New Password.
3. WordPress generates a long, random password. Use it — human-invented passwords are dramatically weaker. Copy it straight into your password manager (Bitwarden, 1Password, or your browser’s built-in manager at minimum).
4. Click Update Profile at the bottom.
5. WordPress may ask whether to log out other sessions — choose to log out everywhere else. This kicks out any old sessions, shared logins, or a developer who no longer works with you.

The official WordPress password reset documentation describes these same official routes, including the email and database methods below, with screenshots.

Method 2: From the Login Screen (Forgot It, or Locked Out)

1. Go to your login page (yourdomain.com/wp-admin or /wp-login.php).
2. Click “Lost your password?” below the form.
3. Enter your username or the admin email address and click Get New Password.
4. Open the email (check spam if it doesn’t arrive in a few minutes) and click the reset link — it’s valid for a limited time.
5. Set a new strong password and log in.

If the email never arrives, your site’s mail sending is broken (common on cheap hosting) — use Method 3 instead, and fix your site’s email delivery afterwards, because password resets and order notifications depend on it.

Method 3: Directly in the Database via phpMyAdmin (Emergency Route)

1. Open your hosting control panel and launch phpMyAdmin.
2. Select your WordPress database and open the wp_users table (the prefix may differ, e.g. wp2_users).
3. Find your admin account’s row — check the user_login column — and click Edit.
4. In the user_pass field, set the function dropdown to MD5 and type your new password in plain text in the value box.
5. Click Go/Save. WordPress detects the MD5 hash on your next login and automatically upgrades it to modern secure hashing.
6. Log in with the new password and immediately set it again via Method 1 (which also confirms everything is working normally).

Method 4: WP-CLI (If You Have Server Command-Line Access)

1. Connect to your server by SSH and navigate to your WordPress folder.
2. Run: wp user update yourusername --user_pass='YourNewStrongPassword'
3. Log in through the normal screen to confirm. Two commands, thirty seconds — the fastest method of all.

What Makes a Password Actually Strong

• Length beats cleverness: 16+ characters matters more than symbols. A four-word passphrase like “correct-horse-battery-staple” style (but your own, not that famous example) is both strong and typeable.
• Unique: Used on this site only. If your email password leaks elsewhere, your site must not fall with it.
• Generated and stored: Let WordPress or your password manager generate it, and let the manager remember it. A password you must memorize is a password you’ll simplify.
• Never “admin”, your site name, or your business name plus a year — bots try exactly those first.

After Changing: Lock the Door Properly

A new password is the moment to finish the job:

• Turn on two-factor authentication with a plugin like Wordfence Login Security or the Google Authenticator plugin — password plus phone code makes stolen passwords nearly useless.
• Review user accounts under Users: delete accounts nobody recognizes and demote anyone who doesn’t need full Administrator rights. Unknown admin accounts are a hallmark of a hacked site.
• Change the password anywhere you reused the old one — hosting, FTP, database — if they matched. (They shouldn’t have, but if they did, now is the time.)
• Update saved logins on your phone and any team tools, so nobody gets locked out mid-work.

These steps are one layer of a bigger picture — our guide on protecting your WordPress login page from attacks covers limiting login attempts, hiding the login URL, and the other defences that stop bots reaching the password form at all.

Common Mistakes to Avoid

• Changing the email and password at the same time without testing: If the new email is wrong, the reset route dies with the old password. Change one thing, verify, then the next.
• Emailing the new password to your team in plain text: Use a password manager’s sharing feature or a one-time secret link. Old emails get forwarded and inboxes get hacked.
• Forgetting hosting-level access: Your hosting account and FTP passwords are just as powerful as wp-admin. They deserve the same strength and uniqueness.
• Sharing one admin account among everyone: Give each person their own account at the lowest role they need. You’ll know who did what, and removing one person doesn’t mean changing everyone’s password.
• Writing it on paper by the monitor: Yes, people still do this. Password manager. Today.

What If Someone Else Might Know the Old Password?

Treat that as a mini-incident, not just a password change. Change the password using Method 1 and choose “log out everywhere else” so existing sessions die immediately. Then check Users for accounts you don’t recognize, look at recent posts and settings for anything you didn’t change, and review your security plugin’s login history for unfamiliar locations. If anything looks wrong, change the passwords on your hosting account, FTP, and database too — they may have been reached through the same door. Only when the user list is clean and the logs make sense should you consider the matter closed; a password change alone doesn’t evict someone who created their own hidden admin account while they had access.

Conclusion

Changing your WordPress admin password safely takes two minutes from the dashboard, five from the login screen, and only slightly longer via phpMyAdmin in a true lockout. Use a generated, unique password stored in a password manager, log out other sessions, and finish by enabling two-factor authentication and reviewing your user list. Do that, and the master key to your website is a key you actually control.

Frequently Asked Questions

How often should I change my WordPress admin password?

There’s no benefit to changing a strong, unique password on a schedule. Change it immediately when someone with access leaves, when you suspect any compromise, or when you’ve shared it somewhere you shouldn’t have. Otherwise, strength plus two-factor beats rotation.

I changed my password and now I’m locked out. What now?

Use the “Lost your password?” email reset. If email doesn’t arrive, go through phpMyAdmin (Method 3) or ask your host’s support to reset it — hosts verify account ownership and can restore access.

Can changing my password break my website?

No. Your password only affects logging in, not your content, design, or visitors. The only side effect is other sessions being logged out, which is usually the point.

What’s the difference between changing and resetting a password?

Changing is done while logged in (you prove identity with the current session). Resetting is for when you’re locked out, and proves identity via your email, database access, or hosting account instead.

Should I also change my WordPress admin username?

If it’s “admin”, yes — it’s the first username bots try. Usernames can’t be edited directly; create a new administrator account with a proper username, log in as it, then delete the old “admin” account, attributing its content to the new one.