You can change the password of your WordPress user account directly in the WordPress Dashboard change. This makes sense if you still know your previous password or still have access to the admin area and want to use a new password for security reasons.
WordPress can automatically generate a strong password. But you can also set your own password. The most important thing is that it long, unique, and not already in use by other services is.
In this guide, we will show you step by step how to change your WordPress password in the dashboard, what to look out for in a secure password, and what you can do if you have forgotten your previous password.
Briefly explained: If you still have access to your WordPress dashboard, you can change your password under User → Profile change. If you have forgotten your password and can no longer log in, you need password recovery instead.
WordPress password, customer center, and cPanel: Do not confuse them #
Before you change your password, you should know, which password you actually want to change. On a WordPress website, there are often several independent sets of login credentials.
This may include, for example:
- WordPress user account or WordPress administrator
- CURIAWEB Customer Center
- cPanel
- FTP account
- Email account
- Database user
When you change your password within WordPress, the change affects only the corresponding WordPress user account. Your cPanel, FTP, email, or CURIAWEB client center password will not be changed by this.
Where can I change my WordPress password? #
First, log in to the WordPress admin area of your website.
On a standard WordPress installation, you can usually reach this via:
Replace your-domain.ch through your actual domain.
After successful login, open the following in the left WordPress menu:
User → Profile
Alternatively, you can also access your own profile via your username or your profile in the top WordPress admin bar.
Change WordPress password step by step #
The password function is located within your user profile in the account management section.
Change WordPress password #
- Log into your WordPress admin area one.
- Open User → Profile.
- Scroll to the section Account management.
- Click on New password on Set new password.
- WordPress automatically generates a strong password that you can use or replace with your own.
- Save your new password securely, for example in a password manager.
- Scroll to the bottom of the profile page.
- Click on Update profile, to save the change.
After saving, the new password applies to your WordPress user account. Use it the next time you log in, along with your username or your registered email address.
Important: Save the new password before leaving the profile page. Especially with automatically generated passwords, you should ensure that the password has been correctly saved in your password manager.
Why does WordPress automatically generate a complicated password? #
When you set a new password, WordPress automatically suggests a strong password. This typically consists of a combination of different characters that is difficult to predict.
This might look less comfortable than a password like MeineFirma2026, but from a security perspective it is significantly better.
A password should not be chosen based on how easy it is for you to remember. That's what password managers are for. What matters is that an attacker cannot easily guess or automatically try the password.
What is a secure WordPress password? #
A good WordPress password should above all long and unique be. Never use the same password for WordPress, your email account, cPanel, and other services.
The following basic rules are recommended for a secure password:
- use as long a password as possible
- use a unique password for WordPress
- avoid names, company names and easily guessable terms
- do not use simple number sequences like
123456 - do not use keyboard patterns like
qwertz - do not use any personal information that could be publicly known
- ideally use a password manager
A long, randomly generated password is usually much better than a short password that has merely been supplemented by a few special characters.
Why should every WordPress account have its own password? #
Password reuse is one of the avoidable security risks. If the same password is used for multiple services and is compromised at one of these services, attackers can try to use the same login credentials on other websites as well.
If you use the same password for WordPress and your email account, for example, a compromised password can endanger multiple accounts at once.
Therefore, your WordPress password should be used exclusively for the corresponding user account.
Password manager instead of memorizing passwords #
With secure passwords, a practical problem quickly arises: nobody wants to remember a different, long, and random password for every website.
That is exactly what password managers are designed for. They can generate secure passwords, store them encrypted, and automatically fill them in during login.
This allows you to use a unique, strong password for every user account without having to memorize all the character strings.
Recommendation: Use a unique password generated by your password manager for your WordPress administrator account. Do not use this password for any other service.
Can I change the password of another WordPress user? #
If your WordPress user account has the necessary permissions, you can also manage the user profiles of other WordPress users and reset their passwords.
As an administrator, you can usually find the existing users under:
Users → All Users
Open the profile of the desired user there and look for the account management section. There you can set a new password and save the change.
This may be necessary, for example, if an employee no longer has access to their account or if you need to change the login credentials of an existing account for security reasons.
Safety Notice: Only change passwords of other users if you are authorized to do so. If a person no longer requires access to the website, you should also check whether the user account should continue to exist.
Do I need to email the new password to another user? #
A password should ideally not be sent unencrypted via normal email. If another user needs a new password, the WordPress password recovery feature is in many cases the better solution.
This allows the user to set a new password themselves via the email address associated with their WordPress account.
This is particularly useful for websites with multiple editors, employees, or external service providers.
What happens to existing WordPress sessions? #
In addition to password management, WordPress also offers a function in the user profile to terminate other active sessions. This feature is particularly useful if you suspect that your user account is still logged in on another computer or browser.
In the field of User → Profile Alternatively, via the account management, you can – if other sessions exist – terminate the corresponding sessions.
This is useful, for example, if you:
- logged into a foreign computer
- no longer use an old device
- lost a computer
- not sure where your account is still logged in
- suspect unauthorized access
If you suspect potential misuse of your WordPress account, you should not only change your password, but also check and terminate existing sessions.
What to do if you suspect a hacked WordPress account? #
If you change your password because you suspect unauthorized access, a normal password change may not be enough.
In this case, check in particular:
- whether unknown WordPress users were created
- whether administrator rights have been changed
- whether unknown plugins were installed
- whether plugins or themes have been unexpectedly modified
- whether unusual redirects occur
- whether content has been changed without your intervention
- whether other administrators could be affected
In the event of a specific security incident, also change other potentially affected access credentials and check the website for tampering.
Just changing the WordPress password does not remove malware if an attacker has already manipulated the website's files or database.
Can I change the username at the same time? #
The password and the WordPress username are two different things.
You can change your password at any time via your user profile. However, the username of an existing WordPress account cannot be easily changed through regular profile management.
Also, do not confuse the displayed name with the actual username. For example, WordPress can publicly display your first and last name or a nickname, while a different username is used for logging in.
What about the user „admin“? #
A username like admin is not a substitute for a strong password. Crucial for the security of your account are, in particular, strong credentials, up-to-date software, correctly assigned user rights, and further protective measures.
When setting up a new WordPress installation, it still makes sense to use a custom administrator username and not choose unnecessarily predictable default names.
We explain how to correctly set up a new WordPress installation in our guide Install WordPress with Softaculous.
Password changed, but login does not work #
If you can no longer log in after changing your password, first check the obvious causes.
Check WordPress login #
- Check that you are logging in to the correct WordPress website.
- Check your username or your email address.
- Carefully re-enter the new password.
- Check if your password manager might still be using the old password.
- When copying, watch out for accidentally inserted spaces.
- Try logging in again.
If the new password still does not work or you are no longer sure which password was saved, use the WordPress password recovery function.
Forgot WordPress password: What now? #
If you forgot your password and therefore can no longer log in to the WordPress dashboard, the method described in this article helps you over User → Profile certainly not anymore.
In this case, you use the function on the WordPress login page „Forgot password?“.
The login page is usually located at:
WordPress will then send a password reset link to the email address associated with the user account.
We will cover the complete process separately in our guide Forgot WordPress admin password: Recover access.
Didn't receive a password reset email? #
If WordPress does not deliver the password reset email, this can have various causes. This does not automatically mean that the stored email address is incorrect.
A common problem with WordPress websites is the unreliably configured delivery of outgoing system emails. In this case, setting up SMTP transmission can help.
In CURIAWEB this is available for GoSMTP PRO free available. This allows WordPress emails to be sent via a correctly configured SMTP setup instead of relying solely on the website's default mail function.
We explain the setup step by step in the article Send WordPress emails via SMTP.
What to do if password recovery doesn't work either? #
If you no longer have access to the WordPress dashboard and normal password recovery does not work, there are other options.
With access to the hosting, the password can be reset directly via the WordPress database, for example. With CURIAWEB, you can access the database management via phpMyAdmin open in cPanel.
This method is significantly more technical and should be carried out carefully. Making changes directly to the database can cause problems if applied incorrectly.
That is why we cover this method separately in the manual Change WordPress admin password via phpMyAdmin.
Steps for a forgotten password: First use the normal WordPress password recovery. A direct intervention via phpMyAdmin is an alternative method if the regular way does not work and you have access to the database.
Should I change my WordPress password regularly? #
A strong and unique password does not need to be changed constantly just because a few months have passed. Frequent forced password changes can even lead to users choosing weaker or predictable variants.
A password change is particularly useful when:
- you suspect that the password has become known
- the password was also used for another service
- you accidentally shared the password
- a device with saved access credentials has been lost
- an unauthorized login is suspected
- you have been using a weak password
More important than a rigid change schedule is a strong, unique and securely stored password.
Additional security for WordPress #
A good administrator password is important, but only one part of a secure WordPress configuration.
You should also make sure that:
- WordPress is regularly updated
- plugins and themes are kept up to date
- remove unneeded plugins
- Users should only receive the permissions actually required
- unused user accounts are checked and removed if necessary
- regular backups are available
- the website is accessible via HTTPS
We cover how to keep WordPress itself as well as plugins and themes up to date in detail in the article Update WordPress: Perform updates safely manually or automatically.
If your website is not yet correctly accessible via HTTPS, you can find the necessary steps in our guide. Enable SSL and HTTPS in WordPress.
Common mistakes with WordPress passwords #
Many problems can be avoided if a few fundamental mistakes are not made.
- use the same password for multiple services
- use a very short password
- Using company names or domain names as passwords
- simple variants like
Password2026!use - Send passwords unencrypted via email
- Store passwords in freely accessible documents
- only changing the password after a security incident and not checking the website any further
- Confusing the WordPress password and the cPanel password
Note: A WordPress administrator has extensive rights on your website. Therefore, treat the login credentials with the same care as other important business login credentials.
Summary #
If you still have access to your WordPress dashboard, you can change your password under User → Profile in the field of Account management change it. WordPress can automatically generate a strong password that you can use directly.
Use for your WordPress account a long and unique password and ideally save it in a password manager. Do not use the same password for WordPress, email, cPanel, FTP, or other services at the same time.
If you have forgotten your WordPress password and can no longer log in, use the instead WordPress password recovery. If this method also does not work, the password can be changed as an alternative method via appropriate hosting access be reset.
