WordPress.com suffers hacker attack – how to change your password

WordPress.comMillions of blog owners around the world are being advised to consider their password security, after WordPress.com was hacked.

To its credit, Automattic – the company behind the WordPress.com blogging platform – didn’t mince its words or try to apply any spin to the incident, explaining it had suffered a “low-level (root) break-in to several of [its] servers, and potentially anything on those servers could have been revealed.”

Automattic’s Matt Mullenweg wrote:

We have been diligently reviewing logs and records about the break-in to determine the extent of the information exposed, and re-securing avenues used to gain access. We presume our source code was exposed and copied. While much of our code is Open Source, there are sensitive bits of our and our partners’ code. Beyond that, however, it appears information disclosed was limited.

Sign up to our free newsletter.
Security news, advice, and tips.

WordPress’s gurus continue to investigate the security breach, and say they have taken steps to prevent it happening again.

It’s worth pointing out that the security incident only potentially affects blogs posted on WordPress.com, not sites which have decided to self-host their own WordPress blog using the software from WordPress.org.

So, until we know more, I think it would be sensible for all WordPress.com users to follow the advice – and consider if they are using a secure password. Better safe than sorry, after all.

Here’s how you change your WordPress.com password, if you think it might not be secure.

1) Go to Users / Personal settings

WordPress personal settings

2) Choose a strong, unique password.

Change your WordPress.com password

Not sure what a strong password is, or why it’s important you should choose a unique one? Watch our video.


We don’t know that the WordPress.com security breach gave the hackers access to bloggers’ passwords, but we do know that many internet users have chosen to use the same password on multiple websites. So if your password was stolen from one website, it could then be used to unlock many other online accounts – and potentially cause a bigger problem for you.

So always use unique passwords.

Furthermore, computer users should ensure they don’t use dictionary words as passwords as it is relatively easy for hackers to figure these out using electronic dictionaries that simply try out every word until they get the right one.

If video doesn’t float your boat, here’s a podcast where we talk around the issues of password security:

Even though your WordPress password may not have been compromised, it still makes sense and is good practice to make sure that you have a chosen a good, strong password now.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.