Locking Down WordPress Admin Accounts

One of my old notes was a recipe for getting into a WordPress site when you've lost the login: open phpMyAdmin from the hosting control panel, paste three SQL statements that insert a user with an MD5() password and give it the administrator capability, then log in. It worked, and it's a trick a lot of us learned years ago.

It's also a good example of how admin accounts end up weaker than they should be. Here's how I'd handle them now. Checked against the WordPress.org and WP-CLIWP-CLIThe command-line tool for WordPress. Anything you'd click through in wp-admin, from updates to new users, you can type or script instead.More: WP-CLI: The Commands I Keep Coming Back To docs in September 2026.

Make accounts the WordPress way

If you have shell access, WP-CLI creates a user properly, with WordPress's own password hashing:

wp user create sam [email protected] --role=editor --prompt=user_pass

--prompt asks for the password so it isn't sitting in your shell history. Leave it out entirely and WordPress generates a strong random one.

As for the MD5 trick: WordPress still accepts a plain MD5 hash so that emergency resets through the database keep working, and since WordPress 6.8 it rehashes the password with bcrypt the first time that user logs in. So if you ever do have to use it, log in straight away and change the password from the profile screen. Just don't make it the normal way accounts get created.

Warning

Whatever password goes into a SQL statement also ends up in your notes, your clipboard history and maybe a support ticket. Treat it as burned and change it after first login.

The lowest role that works

Role	Can do	Give it to
Administrator	Everything, including plugins, themes and users	You, and one backup person
Editor	Publish and edit anyone's posts and pages	Whoever runs the content
Author	Publish and edit their own posts	Regular writers
Contributor	Write drafts, can't publish	Occasional or guest writers
Subscriber	Manage their own profile	Members, commenters

Most site owners don't need to be an administrator day to day. An editor account for daily work and an admin account for updates is a small hassle that pays off the day a password leaks.

Don't use admin or webmaster as a user name. They're the first names every login bot tries.

Scripts get their own keys

Anything automated, like a backup job or a script that posts through the REST API, should use an application passwordapplication passwordA separate password WordPress makes for one script or app. It can use the REST API as you, and you can revoke it without touching your real login.More: The WordPress REST API Without a Plugin: Reading, Creating and Updating Content, not your real login. Each one has a name, works only over HTTPS, and can be revoked without touching anything else:

wp user application-password list sam
wp user application-password create sam "Nightly backup" --porcelain

Make it on an account with only the role the script needs. A script that only drafts posts can live on a contributor or author account.

One line in wp-config.php

wp config set DISALLOW_FILE_EDIT true --raw

This removes the theme and plugin file editors from the dashboard. If someone does get an admin login, they can't paste PHP into your theme from a browser. You'll still edit files the normal way, over SFTP or from your own machine.

Two other items from the official hardening guide worth doing while you're in there:

• Keep wp-config.php readable only by its owner and the web server, since it holds the database password and the site's secret keys.
• Turn on two-factor authentication for every administrator. It's a plugin, not a core feature yet, and it's worth the install.

A quick audit

Run these now and then, and whenever someone leaves a project:

wp user list --role=administrator --fields=ID,user_login,user_email
wp user application-password list sam --fields=name,created,last_used
wp user session destroy sam --all

The last one logs that user out everywhere, which is the right move after a password change.

Tip

Keep every login and API key in a password manager, not a notes app. A note called "passwords" is the first thing anyone goes looking for.

The rest of the toolbox is in the WP-CLI short list, and if a site's already had a bad day, looking after a WordPress database covers backups before you start cleaning up.