Changing your database password

When to change the database password behind your WordPress site, and how to do it without taking the site offline.

Your site was installed with a 23 character random database password, which is long enough to defeat brute force and dictionary attacks. You will not normally need to change it.

The reason to change it is a disclosure that may have exposed the password, as the Heartbleed vulnerability did. Without a reason of that kind, leaving the password alone carries less risk than changing it.

Before you start

WordPress stores the database password in two places. Changing one without the other takes the site offline, because WordPress can no longer reach its database. Do both steps in one sitting, and consider putting the site into maintenance mode while you work.

Generate the replacement at random.org, and make it at least as long as the password it replaces.

Changing the password

1. Find your current database username and password. Both are in wp-config.php in the WordPress directory, which you can reach over SFTP.
2. Log into Adminer for your site, at https://example.com/adminer/ with your own domain in place of example.com.
3. Click Privileges, then Edit beside localhost.
4. Clear the Hashed checkbox.
5. Paste the new password into the Password field and click Save.
6. Open wp-config.php and replace the old password on the DB_PASSWORD line with the new one.

Load your site as soon as you have saved both. If it loads normally, the change has worked.