Trying to figure out if deleting admin user and changing database password will be enough to secure the website afterwards.

1 Answer 1


Security of your WP site is more than that (admin user, database password), although that is a good start. I'd

  • create admin-level user that is not named 'admin', with a strong password. You could even change the user id so that it's not #2 (it's easy enough to enumerate users by id).
  • create a strong password for your database
  • use a different prefix for your database
  • create strong credentials for your hosting place
  • create strong credentials for FTP users (and only use SFTP)
  • remove features (plugins/themes) that you are not using
  • keep everything updates: WP, themes, plugins, PHP
  • use PHP version 7.x+
  • regular backups - off-host
  • htaccess security
  • disable RPC

And that's probably just the beginning. There are good resources on the WP site (and other reputable sites) for WP security - ask the googles/bings/ducks .

  • Hi, thanks for that. I do all of the above. I've given access to someone I don't know very well, not sure I trust them. All they've got at the moment is an admin-level account and database password. They were able to copy the entire website with some plugin using just these credentials. So my question is, how far/deep can they get in having those two passwords (user and database).
    – Phantasmix
    Jun 5, 2020 at 1:35
  • If they have admin level privileges, then they have full control of your site and data. They can install plugins that back up the database and files. Essentially, they can clone any part of your site, and change (even damage) your site. If you don't trust them, consider why they need admin access. Maybe a lower level is better. Right now, it's just like you gave them the keys to your car. And your house. And your checkbook. And... Jun 5, 2020 at 2:30
  • Can they get into Cpanel using the above credentials?
    – Phantasmix
    Jun 5, 2020 at 3:34
  • No, unless the hosting credentials are the same. But that's not your biggest worry, if they have admin access to your site. Depends on how strong/different your credentials are. I'd change everything (hosting, ftp, admin, database, domain registrar, etc) to strong (and different for each item) passwords. This is all assuming that that person has nefarious inclinations. Jun 5, 2020 at 3:57
  • No, hosting credentials are, of course, different. Once they're done fixing, I'll change everything for sure, thanks.
    – Phantasmix
    Jun 5, 2020 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.