Locking down your admin account on day one

Locking down your admin account on day one

The admin account is the master key to your whole site. A few minutes of setup keeps strangers out.

1. If your username is "admin," create a brand-new user (Users, Add New) with the Administrator role and a different name, then log in as them and delete the old "admin."
2. Use a long passphrase, four random words beat a short messy password.
3. Go to Users, Profile and set a separate "display name," so your login name never shows publicly on posts.
4. Add your real email so password resets can reach you.
5. Install a reputable security plugin and turn on two-factor login (a second code from your phone).

In plain words: don't leave the master key under the doormat, rename it, lengthen it, and add a second lock.