Password security guide
WordPress Password Security
Use a unique generated password for every WordPress user, require stronger controls for administrators, and never share the main login password with an integration.
WordPress password recommendations
WordPress.org recommends at least 20 characters, with a mix of upper case, lower case, numbers and special characters. WordPress can generate 24-character passwords in the user profile workflow. Individual hosts, SSO providers and security plugins may enforce different policies.
Use the official generator or this local generator and store the result in a password manager.
Administrator passwords protect more than content
An administrator can install code, create users, change site settings and sometimes reach server or customer data through plugins. Use separate named accounts, the least privilege required and no shared “admin” credential.
Add 2FA or passkeys
WordPress core does not currently provide a universal 2FA user interface. Add it through a maintained plugin, identity provider or hosting control that fits the deployment. Passkey support can likewise be added through maintained WebAuthn-capable components. Enroll at least two safe methods for critical administrators.
Use Application Passwords for integrations
WordPress Application Passwords are per-user, revocable credentials for API access. They are not used for interactive wp-login.php sign-in. Create one per integration over HTTPS, give it a descriptive name, record ownership and revoke it when unused.
Do not put a human administrator password into a deployment script, mobile client or reporting integration.
Limit brute-force and credential-stuffing risk
Use rate limiting, a WAF or application controls, monitor failed logins and disable unused XML-RPC functionality where compatible. Avoid broad lockouts that can be abused for denial of service. Strong unique passwords remain necessary because bots test leaked credentials continuously.
Updates, plugins and hosting still matter
A strong password cannot repair a vulnerable plugin, abandoned theme or exposed hosting account. Keep core, plugins, themes, PHP and server components current; remove unused code; protect backups; and restrict file write access.
WordPress recovery plan
Secure the administrator email and hosting panel separately. Document who can reset users, where backups are stored and how a compromised administrator will be revoked. Test recovery without leaving emergency scripts or temporary credentials on the server.