Choosing a strong password

What makes a password hard to break, and how to keep track of the ones you use.

Length is what defeats an attacker, not punctuation. A short password full of symbols falls to a modern cracking rig far sooner than a long, plain one. Every extra character multiplies the work required.

Aim for at least 16 characters on any account that can change your website, and longer where you can. The passwords we generate during installation are 23 characters for this reason.

Generating one

The safest password is one you never invent yourself, because people reuse patterns without noticing. random.org will generate a set for you in the browser.

Your web browser will also offer to create and remember a strong password whenever you sign up or change one. That is a sound option, and it means the password is stored rather than remembered.

Keeping track of them

Use a different password for every account. Reuse turns one site's breach into a problem everywhere else you used that password. Breaches are common enough to assume it will happen.

A password manager, or the one built into your browser, makes that practical. You then remember one strong password and it handles the rest.

Where it matters most

Protect the accounts that can change or reach your site first. That means your WordPress administrator accounts, your hosting login, and the email account those accounts send password resets to.

Turn on two-factor authentication anywhere it is offered. It keeps an attacker out even when they have the password.