How to Change a WordPress Admin Password After a Hack: Secure Recovery Steps for 2026

How to change a WordPress admin password after a hack

If your WordPress site has been compromised, the first priority is restoring secure admin access without giving attackers another opening.

This guide explains how to change a WordPress admin password after a hack and the immediate recovery steps that matter most.

A hacked admin account is often only one part of the incident, so password reset alone is not enough.

You also need to verify access paths, remove unauthorized users, and lock down the site before you resume normal operations.

What to do first after discovering a hack

Before changing passwords, assess the situation so you do not miss a persistent backdoor.

If you can still log in, act quickly; if you cannot, use recovery methods through hosting or the database.

• Put the site into maintenance mode if possible.
• Notify your hosting provider and ask whether they detected malware or account abuse.
• Check whether other admin users were created.
• Backup the current site files and database for forensic review.
• Scan the site with a security plugin or server-side malware scanner.

How to change a WordPress admin password from the dashboard

If you still have access to the WordPress admin panel, changing the password is straightforward.

This is the safest option because it avoids exposing credentials through a less secure recovery route.

1. Log in to WordPress.
2. Go to Users and select your admin account.
3. Scroll to Account Management.
4. Click Set New Password or enter a strong new password.
5. Save the profile and log out of all active sessions if the option is available.

Use a long, unique password generated by a password manager such as 1Password, Bitwarden, or LastPass.

Avoid reusing any password that has ever been used for email, hosting, or other websites.

How to reset the admin password without dashboard access

When an attacker changes your admin credentials, you may need to reset access through the database, email recovery, or hosting tools.

The right method depends on how your WordPress installation is configured.

Reset through the WordPress login screen

If the admin email still works and has not been compromised, use the built-in password reset link on the login page.

WordPress sends a reset email to the address associated with the user account.

This method is simple, but it is only safe if you trust the email account.

If the email inbox may also be compromised, reset the email password first and confirm that no forwarding rules were added.

Reset through phpMyAdmin

If you have hosting access, phpMyAdmin can be used to update the WordPress database directly.

This is a common way to recover a hacked admin account when the dashboard is unavailable.

1. Open phpMyAdmin from your hosting control panel.
2. Select the WordPress database.
3. Open the wp_users table, or the table with your custom prefix.
4. Find the admin user row.
5. Replace the password value using a secure hashing method supported by WordPress.

In many cases, the easiest approach is to edit the password field and choose the MD5 function in phpMyAdmin, then immediately log in to WordPress and set a new strong password from the profile page.

WordPress will rehash the password using a stronger algorithm after you sign in.

Reset through WP-CLI

If you have shell access, WP-CLI is a cleaner and faster recovery tool.

It is especially useful for managed WordPress hosting environments.

wp user update admin --user_pass='NewStrongPasswordHere'

Replace admin with the correct username or ID.

After updating, log in and confirm the account email, role, and sessions are correct.

Reset through your hosting provider

Some hosts can help you regain access if the admin area is blocked.

They may provide database access, temporary credentials, or server logs that show how the compromise occurred.

Ask whether the host can also check for malicious files in wp-content, suspicious cron jobs, altered permissions, or unauthorized PHP files in uploads folders.

Check whether the attacker changed more than the password

Attackers often modify more than one layer of access.

After you change the password, verify the rest of the account and site structure.

• Review all users under Users and remove unknown accounts.
• Confirm the admin email address is yours.
• Check for changes to the site URL in Settings.
• Inspect plugins and themes for unexpected additions.
• Look for suspicious file edits in wp-config.php and .htaccess.
• Review scheduled tasks and cron events for malware persistence.

If a malicious plugin or theme was installed, delete it after confirming it is not required for normal site operation.

Do not simply deactivate suspicious code; remove it from the server when it is clearly unauthorized.

Secure the connected accounts as well

WordPress admin credentials are often compromised through email, hosting, or a leaked password reused elsewhere.

Securing the site means securing every account tied to it.

• Change the password for the admin email account.
• Change the hosting control panel password.
• Update FTP, SFTP, SSH, and database credentials.
• Enable two-factor authentication on email and hosting.
• Review any password manager sharing links or team access.

If you used the same password anywhere else, assume those accounts are at risk too.

Credential stuffing is one of the most common ways attackers gain access to WordPress sites.

Remove active sessions and revoke trusted devices

Changing the password should invalidate access, but some setups keep sessions active longer than expected.

Force logout wherever possible.

WordPress security plugins such as Wordfence, Solid Security, or WP Activity Log can help you terminate sessions, detect suspicious logins, and alert you to future access attempts.

If your hosting panel supports session management, revoke it there as well.

For extra protection, clear browser cookies on your own devices after recovery and log in again only from trusted machines.

Harden WordPress after regaining access

Once you have recovered the account, strengthen the installation so the same incident is less likely to repeat.

This is the stage many site owners skip, but it is the most important part of post-hack recovery.

• Enable two-factor authentication for all admin users.
• Limit login attempts and consider reCAPTCHA or hCaptcha.
• Update WordPress core, plugins, and themes.
• Delete unused plugins, themes, and old backups from public folders.
• Set correct file permissions for WordPress files and directories.
• Use a reputable security plugin with audit logs and malware scanning.
• Rotate salts in wp-config.php to invalidate old sessions.

You should also create a clean backup after the site is verified.

Keep backups off-server when possible, and test restoration periodically so you know the backup is usable.

Signs the site may still be compromised

Even after the password change, certain symptoms suggest the attacker still has access or left malware behind.

Watch for these red flags over the next several days.

• New admin users reappear.
• Unknown redirects happen on the front end.
• Spam posts or pages are published.
• Files change without your action.
• Google Search Console reports security issues.
• Email sent from the site starts failing or spamming recipients.

If any of these happen, assume the original entry point was not fully removed.

Re-scan the site, review server logs, and inspect recently modified files and database tables.

When to restore from a clean backup

If the compromise is extensive, restoring a known-clean backup may be faster and safer than trying to repair every infected file.

Choose a backup created before the earliest confirmed malicious activity.

Before restoring, make sure the backup itself is trustworthy.

Confirm that the backup source was not stored on a compromised server and that it does not contain backdoors, altered plugins, or injected code.

Prevent another WordPress admin takeover

The best long-term defense is reducing the attack surface around the administrator account.

Strong passwords help, but layered security matters more.

• Use unique passwords stored in a password manager.
• Keep plugins and themes updated automatically where safe.
• Restrict admin privileges to only essential users.
• Audit user roles quarterly.
• Protect wp-admin with two-factor authentication and IP restrictions where practical.
• Monitor login alerts, file integrity, and unexpected plugin installs.

If your site handles sensitive data, consider a managed WordPress host with malware scanning, daily backups, and server-level isolation.

Those controls can shorten recovery time if another incident occurs.

Frequently overlooked recovery checks

During incident cleanup, it is easy to focus only on the admin login and miss hidden persistence mechanisms.

These checks help close the gaps that attackers commonly exploit.

• Inspect mu-plugins for hidden must-use plugins.
• Review wp-content/uploads for executable PHP files.
• Check database options for injected code in widgets or headers.
• Review scheduled posts and navigation menus for injected links.
• Search the database for suspicious JavaScript snippets.

Completing these checks makes it far more likely that your password change will actually restore control, rather than simply delay another takeover.