In many WordPress incidents the attacker’s goal is the same: get an administrator account. A flaw in a plugin can lead straight to it, as with the Modular DS plugin earlier in 2026, where a critical bug let attackers act as an administrator without a password. Even when a plugin is fixed, strong account security limits the damage.
Turn on two-factor login
Two-factor authentication asks for a second code from an app on your phone in addition to the password. Even if a password leaks, the attacker cannot log in. Free plugins such as Two Factor, the official feature plugin from the WordPress community, make this easy. Require it for every administrator and editor.
Passwords and usernames
- Use a unique, long password for every account, stored in a password manager.
- Do not use “admin” as the username and do not publish the administrator login name in author URLs.
- Limit login attempts and consider moving or protecting the login page.
- Never share one administrator account between several people.
Give people the least access they need
A copywriter needs the Author or Editor role, not Administrator. Agencies and freelancers should get their own named accounts that you remove when the work ends. Remember that automation tools, API keys and remote-management connections can act like administrators too, and stolen keys were abused in October 2026, so review and rotate them.
Check your administrators regularly
Open Users and filter by the Administrator role. Every account should belong to a person you know. A new, unfamiliar administrator is one of the clearest signs of a break-in, and some malware tries to hide such accounts from the screen, so a developer may need to confirm the list in the database.
Frequently asked questions
Is two-factor login really necessary for a small site?
Yes. Attackers scan automatically and do not care about the size of the site. Two-factor login is free and takes a few minutes.
What if I lose my phone?
Save the backup codes when you set up two-factor login and keep them somewhere safe. A developer can also reset it through the database.
Should every employee have an administrator account?
No. Most people only need to write or edit content. Keep the number of administrators as small as possible.
Read next
- My WordPress Site Was Hacked: What to Do Step by Step
- WordPress Security Checklist for Business Websites
- The Self-Healing WordPress Backdoor: Why Malware Comes Back After Cleanup
Need help keeping your WordPress site secure? We offer maintenance, updates and security checks. Contact us
