If you only have thirty minutes for security, spend all of it here. The administrator account is the key to everything on the site, and once it changes hands most of your other defences stop mattering. Conversely, getting this one thing right stops a large share of automated attempts at the very first step.
1. The username — do not use a guessable one
An automated login attempt has to get two things right: the username and the password. If your username is admin, administrator, your domain or your company name, the program already knows half of it and only has to keep trying passwords. Making the username unpredictable raises the cost of the whole exercise.
If you already created one called admin, do not rename it — create a new administrator and delete the old account. WordPress lets you reassign the old account’s posts during deletion, so nothing is lost.
One more thing: a well-chosen username helps nothing if it is printed as the author name on every post. In your profile, set the public display name to something different from the login.
2. The password — length beats complexity
For years the rule was “mix in capitals and symbols”, and what that rule mostly produced was P@ssw0rd1! — hard for humans, easy for software. Current guidance is simpler: make it long, and unique to this site.
The genuinely dangerous item there is reuse. Automated attempts routinely replay username and password pairs leaked from other services against many sites, so however solid your own site is, one leak elsewhere opens it. A unique password per site closes that entire route.
You do not have to memorise it. Let your browser or a dedicated password manager hold it, and a long random value becomes easier to use than a short one you type by hand.
3. Two-factor — the line that holds when the password leaks
Even with the first two done, a risk remains: your own machine gets compromised, or you type your password into a convincing phishing page. Two-factor authentication is the second door for exactly that moment. Someone who knows the password still cannot get in without the rotating code on your phone.
When you enable it, store the backup codes somewhere safe. Locking yourself out by turning on two-factor and then replacing your phone is a genuinely common way to lose access.
Fewer accounts is better
Finally, prune the account list itself: temporary administrators from the build, an old agency login, test users. Give administrator rights only to people who truly need them — someone who only writes needs an author role. Every account is another door, and unused doors are better closed.
More on accounts and permissions lives in the security archive, and having a running site’s accounts, permissions and configuration reviewed in one pass is part of our optimization program.
Next part
A well-locked door does nothing about a gap in the wall. The next part covers why updating is security — and what clock starts running the moment a vulnerability is published.