Most hacked websites don’t get broken into by some genius in a hoodie. Somebody guesses the password, or finds it in a leak from another site, and logs straight in through the front door.
That’s annoying, but it’s also good news. Passwords are one of the few security problems you can fix yourself, today, for free or close to it
How passwords actually get cracked
Attackers don’t sit there typing guesses by hand. They use scripts that try thousands of logins a minute against your WordPress login page, your hosting control panel, your email and anything else with a login box.
There are three main ways they get in:
- Brute force. The script just works through combinations until something sticks. Short passwords fall over fast.
- Dictionary attacks. Instead of random combinations, it tries common words, names, sports teams and patterns like “Summer2026!”. If a human would think of it, so will the list.
- Credential stuffing. This is the big one. When a site you used years ago gets breached, your email and password end up in a dump that gets sold and shared. Bots then try that exact combination on every other site they can find. If you reused it, they’re in.
None of this is targeted. Your site doesn’t need to be famous. It just needs a login page, and every WordPress site has one.
What’s at stake if someone gets in
A compromised admin login on a WordPress site gives the attacker full control. Here’s what that usually looks like in practice:
- Spam pages or pharma links injected into your site, which tanks your Google rankings
- Malware that infects your visitors, getting your site flagged as dangerous in browsers
- Your server used to send spam, wrecking your email deliverability
- Customer data taken, which can trigger obligations under Australian privacy law
- A cleanup bill and days of downtime
And it’s not only the website login. Your hosting account, domain registrar and business email are just as important. Lose control of your domain and you can lose your website and your email at the same time.
Long beats clever
For years we were told a good password looks like Tr0ub4dor&3. Capital letter, number, symbol, done. The trouble is those passwords are hard for people to remember and not that hard for computers to crack.
Length matters far more than complexity. Every extra character multiplies the number of guesses needed. A long password made of a few random words, something like copper-lantern-wombat-fiddle, is much harder to crack than a short jumble of symbols, and you can actually remember it. Current guidance from the US National Institute of Standards and Technology (NIST) and the Australian Cyber Security Centre both lean toward long passphrases over forced complexity rules.
A few rules of thumb:
- Aim for at least 15 characters. Longer for anything that matters, like your hosting or admin accounts.
- Use random words, not a phrase. “ilovemyDog2024” isn’t a passphrase, it’s a guessable sentence.
- Skip personal details. Kids’ names, pets, birthdays, your street and your business name are the first things attackers try.
- Don’t do the predictable substitutions. Swapping “a” for “@” or “o” for “0” fools nobody. Cracking tools try those automatically.
Never use the same password twice
If you only change one habit after reading this, make it this one.
Reusing a password means your security is only as good as the worst-run website you’ve ever signed up to. That old forum, the online shop you used once, the app you forgot about. When any of them gets breached, and plenty do, that password is out there. Credential stuffing bots will try it against your WordPress admin, your Gmail and your hosting account within days.
A unique password for every account means one breach stays one breach. It doesn’t turn into a domino run through your whole business.
You can check whether your email address has turned up in known breaches at haveibeenpwned.com. If it has, change the password on that account and anywhere else you used it.
You don’t have to remember any of this: use a password manager
Nobody can remember 80 different long, random passwords. That’s the honest reason most people reuse them. A password manager solves that.
A password manager is an app that stores all your logins in an encrypted vault. You remember one strong master password, and it handles everything else. Two of the most popular options are 1Password and Dashlane. Both work on Windows, Mac, iPhone and Android, and both plug into your browser.
Here’s what they do for you:
- Generate strong passwords. When you sign up for something, it creates a long random password on the spot and saves it.
Fill logins automatically. You don’t type anything. This also protects you from phishing, because the manager won’t autofill on a fake site with a slightly different web address.
Sync across devices. Save a login on your laptop and it’s on your phone too.
Warn you about weak, reused or breached passwords. Both have a dashboard that flags the problem accounts so you can fix them one at a time. - Share logins safely with staff. Instead of emailing the hosting password around or sticking it on a Post-it, you share access through the vault and can take it back when someone leaves.
Store two-factor codes and secure notes. Handy for recovery codes and the other bits you need to keep somewhere safe.
Your vault is encrypted on your device before it’s synced, so the company running the service can’t read your passwords. That’s the whole point.
Which one should you pick? Honestly, either is a big step up from a spreadsheet or the notes app on your phone. 1Password is popular with small teams and has strong sharing features. Dashlane has a very clean interface and built-in breach monitoring. Try the free trial of each and keep the one you find easier to use, because the best password manager is the one you’ll actually use every day.
One rule for the master password: make it a long passphrase, don’t use it anywhere else, and turn on two-factor authentication for the password manager itself.
Add two-factor authentication on top
A strong password is your first lock. Two-factor authentication (2FA) is the deadbolt. Even if someone gets your password, they also need a code from your phone or an authenticator app to get in.
Turn it on for:
- Your WordPress admin account (and every other admin user on the site)
- Your hosting control panel
- Your domain registrar
- Your business email
- Your password manager
Use an authenticator app rather than SMS where you can. Text messages are better than nothing, but they can be intercepted or hijacked through SIM swapping.
Quick WordPress password checklist
- Don’t use “admin” as a username
- Give every person their own login, never a shared one
- Remove old users who no longer need access
Use a long, unique password for every admin account - Turn on 2FA for all administrators
- Limit login attempts or put a firewall in front of your login page
- Change passwords straight away when a staff member or contractor leaves
- Update the passwords for your database and FTP/SFTP accounts if they were set up years ago
The bottom line
Weak and reused passwords are one of the most common ways websites get hacked, and one of the cheapest to fix. Go long, never reuse a password, let a password manager like 1Password or Dashlane do the remembering, and switch on two-factor authentication everywhere it’s offered.
If you’d like a hand locking down your WordPress site, hosting and email logins, get in touch and we’ll go through it with you.
Frequently Asked Questions
How long should my website password be? At least 15 characters, and longer for important accounts like your hosting and WordPress admin. A passphrase of four or more random words is a good way to get there.
Do I still need symbols and numbers? They don’t hurt, but length matters more. A long random passphrase is stronger than a short password stuffed with symbols.
Is it safe to store all my passwords in one place? With a reputable password manager, yes. Your vault is encrypted and protected by your master password, and ideally by 2FA too. It’s far safer than reusing passwords or keeping them in a document or spreadsheet.
What’s the difference between 1Password and Dashlane? Both store, generate and autofill passwords across all your devices and warn you about weak or breached ones. The differences are mostly in the interface and extra features, so try both and go with the one you like using.
Should I let my browser save my passwords? It’s better than reusing passwords, but a dedicated password manager gives you stronger security, works across different browsers and devices, and makes sharing with staff much safer.
How often should I change my passwords? You don’t need to change a strong, unique password on a schedule. Change it straight away if a site you use is breached, if you think someone else knows it, or when a staff member leaves.
What should I do if I think my site’s password has been compromised? Change it immediately from a device you trust, turn on 2FA, check for any admin users you don’t recognise, and get your host to scan the site for malware. If you’re an Ezyweb client, contact us and we’ll help you through it.
