Updated July 2026. This post started life as a short piece about the WordPress 'admin' username. It's grown into a full refresh covering the whole login: username, password and two-factor authentication, all checked against how WordPress works today.
Your WordPress login is a username and a password. An attacker needs both to get in, yet almost everyone spends their effort on the password and leaves the username as the default 'admin' that came with the install. That's half the job done for them before they've started.
This post is about closing that gap, and then going a step further. We'll sort the username, tighten the password, and add two-factor authentication as a backstop so that even if someone gets hold of both halves, they still can't log in. None of it is hard, and you don't need to be technical to do it.
Why 'admin' hands attackers a free head start
Depending on how you installed WordPress, there's a good chance you have a user called 'admin' or 'Admin' still knocking about. People often leave it because it's easy to remember and they don't realise it matters.
It matters because of how the attacks actually work. Most break-in attempts on a WordPress site aren't a person sat there typing guesses. They're automated bots running brute-force attacks, which means relentlessly trying username and password combinations until one works. If the username is already 'admin', the bot only has one thing left to guess. You've turned a two-part lock into a one-part lock.
This isn't theoretical. We've had people come to us worried after their security plugin flagged repeated login attempts by a user called 'admin'. That's exactly the pattern: bots probing the most common username on the internet, because it so often exists.
Changing it doesn't make you invincible, but it puts the second half of the lock back. The bot now has to guess the username and the password, and a non-obvious username is very hard to guess.
Fixing the username
Here's the catch: WordPress won't let you simply rename a user. Once an account is created, the username is fixed. So the safe, no-plugin way is to create a new user and move your content across.
Before you start, take a backup. You're deleting a user account, and a backup means any mistake is reversible rather than a bad afternoon.
First, decide on a username policy. Something unique that isn't your name, your business name or your pet's name, all of which are guessable. A simple approach is a word plus a few numbers, for example fred-5748. Not memorable to a stranger, easy enough for you.
Then:
- Go to Users > Add New in your WordPress dashboard.
- Create a new user with your chosen username and set the role to Administrator. You'll need to use a different email address to your current admin account for now (WordPress won't allow two accounts on the same email). You can swap it back later.
- Log out, then log back in as the new user. You can't delete an account you're currently logged into, which is why this order matters.
- Go to Users > All Users, find the old 'admin' account and click Delete.
- WordPress will ask what to do with that user's content. Choose 'Attribute all content to' and pick your new account from the dropdown. This moves your posts and pages over so nothing is lost.
- Confirm the deletion. Once the old account is gone, you can change your new account's email back to your usual address.
That's it. Same content, same access, no 'admin' user for a bot to lean on.
Not comfortable doing this yourself? There's a plugin route. The free Change Username plugin adds a rename option straight to the user edit screen, keeping the same account and all its content in place, no new-user shuffle required. It's a fair option if the steps above make you nervous. Just remember every plugin is extra code to keep updated, so if you're happy with the manual method, that's the leaner choice. And a word of warning: avoid editing the database directly through phpMyAdmin unless you genuinely know your way around it. It works, but it's the easiest way to lock yourself out, and it's rarely worth the risk for what you gain.
The password half people get wrong
With the username sorted, the password is the other half of the lock, and this is where a lot of well-meaning effort goes astray.
The old advice was to make passwords complicated: a capital here, a symbol there, a number on the end. The trouble is Password1! is complicated and still terrible. What actually makes a password hard to break is length and unpredictability, not a scattering of symbols on something short.
Three things matter:
- Length. A longer password is exponentially harder to crack. A short, complex one is easier to break than a long, simple one.
- Uniqueness. Never reuse a password from another site. If that other site is breached, attackers try the same email and password everywhere else, and your WordPress login is on that list.
- A password manager. This is the bit that makes the other two realistic. A password manager generates and remembers a long, unique password for every account, so you never have to. Let WordPress's own password generator create a strong one, then store it. You only need to remember the one password that opens the manager.
If you do nothing else here, stop reusing passwords. It's the single most common way accounts get taken over, and a password manager fixes it in an afternoon.
Two-factor authentication: the backstop that covers both
Here's the honest bit. Even with a strong username and a strong password, both halves can still be stolen, through a phishing email, a leak, or a reused password from somewhere else. That's where two-factor authentication comes in, and it's the highest-value step on this whole list.
Two-factor authentication (2FA) means that after your password, WordPress asks for a second proof of identity, usually a six-digit code from an app on your phone. Even if an attacker has your username and password, they don't have your phone, so they're stopped at the door. It's the same principle your bank uses.
WordPress doesn't include 2FA as standard, so you add it with a plugin. A few solid, free options as things stand:
- WP 2FA by Melapress is the easiest starting point for most sites. A setup wizard walks you through it, and even the free version lets you require 2FA across different users, which matters if more than one person logs in.
- Two Factor, the plugin maintained by contributors close to WordPress core, is a clean, no-upsell choice if you're comfortable with each user setting it up from their own profile.
- Wordfence bundles 2FA into its wider security plugin, so if you're using Wordfence already (more on that next), you may not need a separate one at all.
Whichever you pick, use an authenticator app such as Google Authenticator, Authy or 1Password rather than codes sent by text. Text-message codes are better than nothing, but they can be intercepted, so an app is the stronger choice. And whatever you set up, save the backup codes it gives you somewhere safe. They're your way back in if you lose your phone.
Watch the door with Wordfence
The steps above harden the login itself. It's worth also watching who's trying the handle, and that's where a security plugin earns its keep.
We often recommend Wordfence. As well as the 2FA mentioned above, it can alert you when failed login attempts spike, and lock out anyone who fails too many times in a row, which shuts down brute-force bots before they get anywhere. It also handles malware scanning, firewall protection and real-time threat monitoring, so it's watching the whole site, not just the front door.
One current note worth knowing: Wordfence is retiring its separate 'Login Security' plugin on 1 July 2026. If you've installed that standalone version, move to the main Wordfence plugin, which has the same login features built in. If you're setting up fresh, just install the main plugin and you're covered.
Pulling it together
You started with a login where one half, the username, was very likely the default 'admin' that every bot on the internet tries first. Work through this and you've changed the picture completely:
- The username is unique and unguessable, so the lock has two real halves again.
- The password is long, unique and kept in a manager, not reused from somewhere that might leak.
- Two-factor authentication means even a stolen username and password aren't enough to get in.
- Wordfence is watching for attempts and shutting down the bots that come knocking.
That's the whole login covered, not just the half most people stop at. None of it takes long, and it's the difference between a site that's an easy target and one that simply isn't worth the effort.
This is security, and security moves, so it's worth a look over once in a while to check nothing you rely on has changed. But get these four in place and you're a very long way ahead of most WordPress sites out there.
Frequently asked questions
Can I change my WordPress admin username directly?
No. WordPress locks the username once an account is created, so there's no rename option on the profile screen. The safe workaround is to create a new user with your chosen username, set it as an Administrator, then delete the old account and attribute its content to the new one. A plugin such as Change Username can do it in place if you'd rather not shuffle accounts.
Is it safe to delete the old 'admin' user?
Yes, as long as you tell WordPress to attribute all content to your new account when it asks. That moves your posts and pages across so nothing is lost. Take a backup first, purely so any slip is reversible, and always create and log in as the new user before deleting the old one, since you can't delete the account you're currently using.
What makes a strong WordPress password?
Length and uniqueness, far more than a scattering of symbols. A long password is exponentially harder to crack than a short, complex one, and it should never be reused from another site that might be breached. The practical way to manage that is a password manager, which generates and remembers a long, unique password for every account so you don't have to.
Does WordPress have two-factor authentication built in?
No, you add it with a plugin. Good free options as things stand are WP 2FA, which walks you through setup with a wizard, and Two Factor, maintained by contributors close to WordPress core. Use an authenticator app such as Google Authenticator or Authy rather than text-message codes, and save the backup codes somewhere safe in case you lose your phone.
Do I still need a security plugin if I've done all this?
Yes. Hardening the login protects the door; a security plugin such as Wordfence watches who's trying the handle. It can alert you to spikes in failed logins, lock out repeat offenders, and adds malware scanning and firewall protection on top. Note that Wordfence is retiring its separate Login Security plugin on 1 July 2026, so use the main plugin, which has the same features built in.
