Your WordPress administrator account can change site content, install code, and manage users. A few simple habits reduce the risk of account takeover.

Use a unique password

Choose a long password that you do not use for email or another website. A password manager can create and remember a unique password. If your host or WordPress setup supports multi-factor authentication (MFA), enable it for every administrator.

Review administrator users

  1. In WordPress, open Users → All Users.
  2. Confirm each administrator is a person who still needs that access.
  3. Remove former users or lower their role when full administrator access is unnecessary.
  4. For accounts you keep, confirm the email address is current and protected.

Keep recovery options safe

Use a mailbox you control for password resets, protect that mailbox with MFA, and keep your hosting account credentials separate. Avoid sharing one admin login among multiple people; individual accounts make access easier to review and revoke.

When access looks wrong

If you notice an unfamiliar administrator, unexpected password-reset messages, or changes you did not make, contact your host promptly. Change passwords from a clean, trusted device, review users and recent activity, and ask for help checking the site files. A password change alone may not remove malicious code.

Good routine: Review administrator accounts whenever a staff or vendor relationship ends, and periodically check that MFA and recovery email access still work.
Source