If you own a WordPress website, there’s a good chance that at some point you’ll need to give someone else access to it.
Maybe you’ve hired a web designer, developer, SEO specialist or virtual assistant. Maybe your hosting company needs to troubleshoot something, or you’ve found someone to help fix a problem on your website.
And this is where I see a surprisingly common security mistake.
Someone asks for your WordPress login details and the website owner simply sends their username and password by text message or email.
Please don’t do this.
Your WordPress login is the key to your website. Depending on the level of access attached to that account, someone who can log in may be able to change your website, install plugins, create new users, access website data or make other significant changes.
WordPress itself recommends strong, unique passwords and two-factor authentication, and its security guidance stresses the importance of controlling who has access to your website.
Never share your own WordPress password
The easiest way to give someone access to your website is not necessarily the safest.
If someone asks for your WordPress username and password, don’t send them your own login details. Instead, create a separate user account for them.
This is important because your WordPress password shouldn’t be treated like a spare key that you can hand around whenever someone needs to pop in.
There’s another problem with sharing passwords by email or text. While email may be encrypted while it travels between some mail servers, ordinary email isn’t generally end-to-end encrypted, and messages can remain sitting in inboxes, sent folders, backups or devices. The same principle applies to text messages: they aren’t the place I’d choose to send a valuable password.
The FTC recommends that businesses don’t share passwords by phone, text or email and instead use secure methods for protecting and sharing sensitive information.
And there’s an even bigger problem if you’ve used that same password anywhere else.
If your WordPress password is also your password for another account, giving it to someone else means you’ve potentially exposed more than just your website. Password reuse is a well-known security problem because stolen credentials can be tried against other online accounts.
Create a separate WordPress user account instead
A much safer approach is to create a separate WordPress user for the person who needs access.
For example, if you’re giving your web designer access, create a user using their own email address rather than giving them your login.
This means they have their own login, their own password and their own account. You haven’t had to hand over your personal WordPress credentials at all.
Even better, only give them the level of access they actually need.
If someone only needs to edit pages, they probably don’t need full Administrator access. If someone needs to install plugins or make technical changes, they may need higher permissions, but that should be a deliberate decision rather than simply giving everyone Administrator access because it’s easier.
This is known as the principle of least privilege: give someone the access they need to do their job, and no more.
Make the access temporary
If someone only needs access for a short period, there’s no reason for that access to remain active indefinitely.
For example, if a developer needs access to investigate an issue on your website, you could create a temporary account that expires after the work is finished.
There are WordPress tools that allow you to create temporary users or expiring login links, so you can give someone access without sharing your own password. Some allow you to set an expiry time and automatically disable or delete the temporary account afterwards.
This is particularly useful when you’re working with a freelancer or developer you’ve never worked with before.
Once the job is finished, remove their access.
Don’t leave a collection of old accounts sitting in your WordPress dashboard because you might need them again one day.
If you do work with someone regularly, give them their own proper user account rather than sharing yours. That way you can remove their access if the working relationship ends without having to change your own login.
What if someone has already been given your password?
Don’t panic, but don’t ignore it either. If you’ve already sent your WordPress password to someone else, I’d change it once they’re finished.
And if that password has been used anywhere else, change it there too.
This is particularly important if you’ve used the same password for your email, hosting account, domain registrar or other important services. A compromised email account can be particularly serious because password reset links for other accounts often go there.
If you’re unsure who has had access to your WordPress login, changing the password and signing out existing sessions is a sensible security step.
How often should you change your WordPress password?
This is one area where security advice has changed over the years.
You may have been told to change every password every 30, 60 or 90 days. That’s no longer considered necessary simply for the sake of changing it.
Instead, use a strong, unique password and change it when there’s a reason to believe it has been exposed, shared or compromised.
For a website owner, I’d recommend reviewing your important WordPress and hosting accounts regularly and changing the password immediately if you’ve shared it, suspect someone else has accessed it, or there’s been a security incident.
WordPress recommends long, strong passwords, with its current documentation suggesting at least 20 characters, and recommends using a password manager rather than trying to remember lots of different passwords.
Turn on two-factor authentication
Your password shouldn’t be the only thing protecting your WordPress Administrator account.
If your WordPress security setup supports two-factor authentication, turn it on. With 2FA, someone needs something more than just your password to sign in. Depending on the system, that second factor might be an authenticator app, security key or another verification method.
This gives you an additional layer of protection if your password is stolen.
The Cybersecurity and Infrastructure Security Agency recommends MFA because it makes it much harder for someone to access an account even if they have obtained the password. WordPress also recommends two-factor authentication as part of its security guidance.
For your most important accounts, I’d also make sure you’re using 2FA on your email account, hosting account and domain registrar, not just WordPress.
What about sending a password securely?
Sometimes you genuinely do need to send someone a sensitive piece of information.
If I need to send a password or other sensitive detail, I use Password Link’s one-time sharing solution rather than putting the actual password into an email or text message.
Passwork allows you to create a single-use link that expires after it has been opened. This means you’re not leaving the password sitting permanently in an email conversation or message history.
It isn’t a replacement for creating individual user accounts where possible. A separate WordPress user is still the better option when someone needs ongoing access to your website.
But for those occasions when you genuinely need to share a sensitive piece of information, a one-time secret link is a much better approach than typing the password into an email and hoping nobody ever gets access to that inbox.
A simple WordPress security rule to remember
- If someone needs access to your website, don’t give them your logins. Create them their own logins.
- If they only need access temporarily, make the access temporary.
- If they don’t need Administrator permissions, don’t give them Administrator permissions.
- If you’ve already shared your password, change it afterwards, particularly if that password has been reused anywhere else.
Your website might not seem like a particularly exciting target to a hacker, but your WordPress Administrator account can provide a surprisingly powerful level of access. A compromised administrator account can be used to make changes to the website and potentially install malicious code or gain access to other information.
A few extra minutes spent setting up user access properly can save you a very unpleasant website security headache later.
WordPress user safety checklist
Before giving someone access to your website, ask yourself:
- Do they need access at all?
- Can I create a separate WordPress user for them?
- What user role do they actually need?
- Can I make the account temporary?
- Have I enabled 2FA on my Administrator account?
- Is my WordPress password unique and strong?
- Have I used that password anywhere else?
- If I need to send a sensitive password, am I using a secure one-time sharing method?
- Once the work is finished, have I removed their access?
Website security isn’t just about firewalls, malware scanners and keeping your plugins updated. It’s also about the very simple things we do every day, like deciding who gets the keys to the website and how we hand those keys over.