WordPress Password Security: Why Your Password Is the Biggest Risk

When a WordPress site gets hacked, suspicion falls on missing technology by reflex: no security plugin, no firewall, no malware scanner. The uncomfortable truth looks different. In practice the biggest weak spot on almost every WordPress site is far more mundane: weak, reused or guessable user passwords. An attacker who logs in with valid credentials sets off no firewall alarm at all. They are simply inside.

This article explains why passwords are the number one way in, clears up the most stubborn password myths and shows you a method for building genuinely strong passwords that you can still remember. And because the topic matters so much, we built a free tool that takes the work off your hands.

Why passwords are the number one way in

WordPress logins are not attacked by bored individuals but by botnets working around the clock. Two attack patterns dominate:

Brute force and dictionary attacks: bots systematically work through millions of combinations, starting with the classics like 123456, password or the site name plus a year. Short or obvious passwords do not fall in weeks, they fall in seconds to minutes. Preferred targets are wp-login.php and the often forgotten interface xmlrpc.php: its system.multicall function lets hundreds of password attempts be packed into a single request, which sidesteps classic login limits elegantly. If you do not need XML-RPC, for a Jetpack connection or old app links, switch the interface off.

Credential stuffing: even more efficient is not guessing at all. Billions of real email and password combinations circulate from breaches at other services. Bots simply try those lists against WordPress logins. If you use the same password for the online shop, the email account and the WordPress admin, the next leak at any one of them compromises you everywhere at once. Password reuse is therefore not a blemish, it is a direct line from someone else's breach into your admin area.

A security plugin can catch and slow many of these attempts, which is valuable. But no firewall in the world helps against a valid password that was stolen or guessed. Password hygiene therefore comes before any plugin decision.

The three biggest password myths

Rules survive around passwords that were well meant twenty years ago and today demonstrably do more harm than good. Even the American NIST and the German BSI have switched their recommendations accordingly.

Myth 1: a jumble of symbols beats length

The short P@ssw0rd! looks safe and is not: exactly these substitutions (a to @, o to 0, exclamation mark at the end) have long been part of every dictionary attack. A password with eight cryptic characters is mathematically far weaker than one with twenty simple ones. Length beats complexity, and not narrowly but by orders of magnitude. Every extra character multiplies the attacker's effort instead of merely adding to it.

Myth 2: passwords have to be changed regularly

Forced changes every 90 days lead to a predictable pattern in practice: Summer2025! becomes Autumn2025!. Such rotations lower actual security, because people build memorable systems that attackers know just as well. The modern recommendation is: a strong password stays until there is a concrete reason to change it, such as a breach at the service or the suspicion that someone has been reading along. Then it is changed immediately, not by calendar.

Myth 3: "my blog is too small to be attacked"

Bots do not care about reach. They scan IP ranges and domain lists from end to end, and a small gardening blog is just as interesting to them as a large magazine: as a spam relay, a phishing host, an SEO link farm or a stepping stone for further attacks. The question is not whether your login page is being attacked automatically. It already is, probably several times a day. The only question is whether the attempts come to nothing.

What actually helps: length, randomness, uniqueness

The strength of a password comes down to a single term: entropy, the amount of real randomness inside it. Put simply: how many possibilities does an attacker have to work through before finding your password for certain? Every extra random character multiplies that number. A random password with 12 characters from letters, digits and symbols already offers more combinations than every computer on earth could try in centuries, and one with 16 to 20 characters is practically uncrackable for the foreseeable future.

The decisive word is random. The opening line of a song 20 characters long is not random, it sits in the same lists as the dictionaries. That gives three simple rules:

1. Length: at least 16 characters, more is welcome. 2. Randomness: the building blocks must be rolled, not invented, because people are miserable random generators. 3. Uniqueness: every service gets its own password, so that a leak at service A does not open service B. Follow all three and the password problem is solved at its core. Only one question remains: how do you remember something like that?

The story method: passwords from pictures and stories

Our brain is bad at character soup and excellent at pictures and stories. That is exactly what the story method uses: instead of memorising Un1c0rn!Id34#B4thtub-4711 as a string, you memorise an absurd picture: "The unicorn has an idea in the bathtub" 🦄💡🛁. From that sentence the password is derived by fixed, simple rules: take the striking words, replace a few letters with digits, add separators and a number. The picture is odd enough to stick, and the derived password is long, mixed and appears in no dictionary.

The catch with stories you invent yourself: people think up predictable sentences. The story should therefore be rolled, not chosen. We built a small tool for exactly that.

One thing to place correctly: the story method is meant for the few passwords you genuinely have to carry in your head. For all the others there is a better answer, more on that in a moment. A fuller guide to the method itself, including a worked example, is in our article Create a secure password.

Concrete measures for WordPress operators

A strong password of your own is half the job. The other half: making sure that every other account on your site is not a way in either. These five measures cover the practice:

1. A strong password policy for every role

The strongest admin password helps little if an editor account is secured with summer123. Accounts with fewer rights are valuable loot too, for spam content or as a starting point for privilege escalation. WordPress shows a strength meter when a password is chosen but still allows weak passwords on confirmation. An enforced minimum strength for all roles, by plugin or by team policy, closes that gap. Anyone running a membership area carries particular responsibility: hundreds or thousands of user accounts quickly hang on your site, and you protect their credentials too. If you are planning or running something like that, pick a solution that thinks about security from the start, such as our MemberJet with security by design. What the paid tiers cost is on the pricing overview, and the free version stays free.

2. Switch on two factor authentication

A second factor (an authenticator app or a security key) makes a stolen password worthless on its own. For admin and editor accounts, 2FA should be mandatory rather than optional. Setting it up takes a few minutes per account and is by far the most effective addition to a strong password.

3. Limit login attempts

By default WordPress allows unlimited login attempts, a gift to every brute force bot. A limit followed by a block or a waiting period slows automated attacks down drastically. Many of the common security plugins bring this function along, and as described above xmlrpc.php belongs in the limit as well, otherwise the attack simply continues through the back door.

4. Application passwords instead of your main password for APIs

When external services, apps or scripts access your site through the REST API, your main password does not belong there. WordPress has shipped application passwords since version 5.6: separate, randomly generated access codes per application that you can revoke individually without changing your actual password. If a service leaks such a code, you withdraw that one code and everything else stays untouched.

5. No username "admin"

The username is half of the access combination, and admin is the first half that every bot tries. An individual username is no strong protection in itself, but it sorts out the dumbest 90 percent of automated attempts in advance. If your admin account still runs on admin: create a new account with its own name, transfer the rights, delete the old account.

For everything else: the password manager

The story method is deliberately meant for a handful of passwords: the two or three you cannot look up anywhere, meaning the master password of your password manager and the login of your devices. For every other account the password manager is the standard recommendation, with no ifs or buts: it generates a long, random, unique password for every service and remembers it for you. The uniqueness rule is then met automatically, and credential stuffing comes to nothing at your site.

So the division of labour is simple: a strong master password built with the story method protects the password manager, the password manager protects everything else, and two factor authentication secures the most important accounts on top. Combine those three building blocks and you have done more for the security of your WordPress site than any single well configured security plugin can do alone.

Frequently asked questions