Secure WordPress admin logins with long unique passwords, two step authentication, one named account per person, HTTPS for the dashboard, and as few Administrator accounts as possible. Each step is cheap, and together they cut the most common route into a site: stolen or guessed credentials.
What the official guidance recommends
The WordPress hardening guide advises avoiding dictionary words and short passwords, avoiding numeric only or alphabetic only passwords, using the strength meter when changing a password, and enabling two step authentication. It also tells you to avoid easily guessed usernames such as admin or webmaster.
On transport, WordPress has a FORCE_SSL_ADMIN constant that requires SSL for logins and the admin area, so passwords and cookies are never sent in the clear. Your host must support HTTPS, which the WordPress requirements page lists as a recommendation.
A practical checklist
| Control | Do this |
|---|---|
| Passwords | Use a password manager and unique, long passphrases |
| Two step sign in | Required for every Administrator and Editor |
| Usernames | One named account per person, never a shared login |
| Default account | Rename or remove one called admin |
| HTTPS | Force it for the dashboard |
| Roles | Give people the lowest role that works |
| Offboarding | Disable accounts the day someone leaves |
Roles reduce the damage
The roles documentation describes Administrator as access to all administration features on a single site, while an Editor can publish and manage posts, an Author manages their own posts, and a Contributor cannot publish. Only administrators have the capability to install plugins. Giving a content editor the Administrator role hands them the power to install code.
The shared account problem
Agencies often keep one shared login per client. That makes it impossible to say who did what and difficult to remove a person without changing the password for everyone. Use individual accounts and an audit trail where possible.
Steps to roll this out
- List all users with the Administrator role on each site.
- Downgrade anyone who does not need the role.
- Turn on two step sign in for the rest.
- Remove accounts of people who have left.
- Set the HTTPS constant and confirm login works.
- Repeat quarterly.
Do not forget the hosting panel
The WordPress login is one door. Hosting, DNS and the database have their own credentials, and they deserve the same care. If you also review the code behind the login page, Safeguard can scan a repository for dependency manifests and produce an SBOM, and there is a free scan at gold.safeguard.sh/scan.
Quick check
Is renaming the admin user enough?
No, but it removes a guessable name. Combine it with strong passwords and two step sign in.
Which role can install plugins?
Administrators. Editors, Authors, Contributors and Subscribers cannot, per the roles documentation.
Sources
- WordPress: hardening
- WordPress: roles and capabilities
- WordPress: editing wp-config.php
- WordPress: requirements
Last reviewed: 19 October 2026.
