What to do first after a WordPress hack
If your site has been compromised, the first priority is stopping further access.
This guide explains how to reset all WordPress passwords after a hack and lock down the site before attackers can return.
Start by assuming every credential tied to the site may be exposed, including admin logins, hosting accounts, and database access.
Then work through resets in the right order so you do not lock yourself out or miss a backdoor.
Why password resets alone are not enough
Changing one administrator password rarely removes a skilled attacker.
Intruders often create hidden admin users, steal session cookies, plant backdoors in files, or abuse weak recovery emails.
That is why password resets must be part of a broader incident response process.
The goal is to remove attacker access, identify how they got in, and reduce the chance of reinfection.
Which accounts should you reset?
When learning how to reset all WordPress passwords after a hack, prioritize every account that could reach the site or its data.
- All WordPress administrator accounts
- Editor, author, and subscriber accounts if they were compromised or unknown
- Hosting control panel accounts such as cPanel, Plesk, or managed hosting dashboards
- SFTP, FTP, SSH, and file manager logins
- Database users, especially MySQL credentials
- Email accounts tied to password recovery
- Staging site and subdomain logins
- Any connected third-party services, including CDN, DNS, and backup tools
How to reset all WordPress passwords after a hack?
The safest approach is to reset from the outside in: hosting, database, WordPress admin users, then recovery-related services.
This order helps ensure attackers cannot simply use a compromised hosting account or email inbox to regain access.
1. Secure the hosting account first
If an attacker controls the hosting panel, they can change files, databases, and passwords again.
Reset the hosting account password immediately and enable two-factor authentication if your provider supports it.
Check for unfamiliar users, API keys, SSH keys, and recently added authorized devices.
Review access logs for suspicious logins, especially from unfamiliar countries or IP addresses.
2. Change file access credentials
Reset SFTP, FTP, SSH, and panel-specific file access passwords next.
If SSH keys are used, revoke any key pairs you do not recognize and regenerate the ones you do.
For shared hosting, remove outdated FTP users and create new credentials only for current administrators.
This reduces the chance that a stolen legacy password still works.
3. Reset the database password
The WordPress database stores posts, users, settings, and plugin data.
Change the MySQL password in your hosting panel, then update the credentials in wp-config.php so WordPress can connect again.
After updating the database password, confirm that the file permissions on wp-config.php are restrictive and that no unauthorized edits were made.
Attackers sometimes hide access tokens or malicious code in configuration files.
4. Reset every WordPress user password
From the WordPress dashboard, change passwords for all legitimate users.
If you cannot trust the dashboard, you can reset users through the database, WP-CLI, or your host’s recovery tools.
Pay close attention to administrator accounts.
Remove any admin user you do not recognize, and inspect each account’s registration date, email address, and recent activity.
- Force password resets for all users
- Delete unknown admin accounts
- Downgrade unnecessary admin privileges
- Review role assignments for editors and authors
5. Reset email and recovery access
WordPress password recovery depends on email accounts.
If an attacker has access to the inbox tied to your site, they can trigger password resets over and over.
Change passwords for email accounts associated with the domain, enable multi-factor authentication, and review forwarding rules, filters, and recovery phone numbers.
Remove any suspicious forwarding that silently copies messages elsewhere.
How to force a WordPress password reset for all users?
There are several reliable ways to force resets across the site.
The best option depends on whether you can still access the dashboard or need to use server-level tools.
Using the WordPress dashboard
If you still have access, ask each user to update their password manually.
This is simple, but it is not ideal after a breach because you cannot guarantee every user will comply quickly.
You can also use a password reset plugin or a security plugin with bulk reset features.
Choose well-known plugins from reputable vendors such as Wordfence, Solid Security, or similar trusted providers.
Using WP-CLI
For administrators comfortable with command line access, WP-CLI can reset passwords efficiently.
It is often the fastest way to rotate credentials on larger sites with many users.
WP-CLI also helps when the dashboard is broken or compromised.
If you use it, make sure the server itself is clean before running commands.
Using the database
As a last resort, you can update password hashes directly in the database.
This should be done carefully because improper changes can break authentication or expose data.
Use database access only if you understand the schema and can verify the site is under your control.
When possible, pair any database reset with a full malware scan and file integrity check.
What else should you check after resetting passwords?
Passwords are only one layer.
A thorough response includes checking for persistence mechanisms that let attackers return even after credentials change.
- Unknown administrator users
- Modified theme files, especially
functions.php - Suspicious plugins or nulled themes
- Recently changed
.htaccessrules - Encoded or obfuscated PHP in uploads, mu-plugins, or wp-content
- Backdoors in cron jobs or scheduled tasks
- Unexpected redirects, spam links, or injected scripts
Also inspect security logs, web server logs, and WordPress activity logs if available.
Logs can show the initial entry point, whether the attacker used a vulnerable plugin, brute force, stolen credentials, or an exposed admin endpoint.
Should you rotate security keys and salts?
Yes.
WordPress authentication keys and salts in wp-config.php help secure login sessions and cookies.
If attackers stole session data, rotating these values will invalidate existing sessions and force users to log in again.
This step is especially important if the breach involved admin session hijacking.
Regenerating salts is a quick way to reduce the value of stolen cookies.
How to make reset credentials safer going forward
Once access is restored, use stronger account controls so you do not need the same recovery process again.
This is the best time to tighten identity and access management across the site.
- Enable two-factor authentication for admin and hosting accounts
- Use unique passwords stored in a password manager
- Remove shared logins
- Limit administrator privileges to the smallest necessary group
- Keep WordPress core, plugins, and themes updated
- Install a reputable security plugin with file integrity monitoring
- Set up regular offsite backups and verify restore tests
Common mistakes to avoid
Several errors can leave a hacked site vulnerable even after a reset.
Avoid rushing through the process or assuming a single password change is enough.
- Resetting only the WordPress admin password
- Ignoring hosting, FTP, SSH, and database credentials
- Leaving unknown admin accounts active
- Failing to change email recovery access
- Reusing the same password on multiple services
- Restoring infected backups without scanning them first
- Skipping log review and file integrity checks
When should you involve your host or a security professional?
If malware keeps returning, the site is redirecting users, or you cannot determine the infection source, contact your hosting provider or a WordPress security specialist.
Managed hosts may help isolate the account, restore clean backups, or provide server logs.
Professional help is also valuable if the site handles customer data, eCommerce transactions, or membership accounts.
In those cases, prompt containment and evidence preservation matter as much as cleanup.
Final checks before reopening the site
Before putting the site fully back online, confirm that all critical credentials have been changed, suspicious accounts are removed, and the site files are clean.
Then test login behavior, forms, and checkout flows to make sure nothing was broken during recovery.
A careful reset process does more than change passwords.
It restores control, blocks common reinfection paths, and gives you a cleaner baseline for ongoing WordPress security.