Originally published: April 13, 2022 · Last updated: August 16, 2026
For years, organizations told users to change passwords every 60 or 90 days. Modern guidance has moved away from that rule. NIST’s current digital identity guidance says verifiers should not require periodic password changes unless there is evidence that the authenticator has been compromised.
For website owners, that changes the priority: stop inventing a new variation of the same password every quarter and build a system around unique credentials, a password manager and multi-factor authentication.
Use a unique password for every important account
Your WordPress admin, hosting account, domain registrar, email account, analytics and payment services should not share passwords. Reuse turns one compromised service into a route to several others.
A password manager makes unique credentials practical because you do not need to memorize every password yourself.
Prefer length over composition tricks
NIST’s current guidance emphasizes password length and explicitly says verifiers should not impose arbitrary composition rules such as requiring a specific mix of uppercase letters, numbers and symbols.
For accounts that still use passwords, let the password manager generate a long random value or use a long passphrase when you genuinely need to type it manually.
Do not change strong passwords on a calendar
Forced periodic changes often encourage predictable patterns such as changing one number at the end. That creates work without necessarily improving security.
Change a password when:
- the service reports a breach or compromise;
- you reused the password somewhere else;
- someone who knew it should no longer have access;
- you discover the credential was weak or exposed;
- there is suspicious account activity.
A strong unique password stored safely does not become weak merely because it has existed for 91 days.
Enable multi-factor authentication
MFA adds another barrier when a password is stolen. Prioritize it for your email, registrar, hosting provider, WordPress administrator accounts and other services that can control the site.
Where a service supports passkeys or stronger phishing-resistant authentication, consider those options as well. Keep recovery methods current so security improvements do not become an account-recovery problem.
Protect the email account that resets everything else
Password reset links for WordPress, hosting and many SaaS tools often arrive by email. That means the mailbox can become the master recovery path for the entire website stack.
Give the primary email account the same or greater protection as the site itself: unique credentials, MFA and secure recovery options.
Review WordPress user accounts
Remove accounts that no longer need access and assign the lowest role that fits the person’s job. A contributor does not need administrator privileges simply because that is easier to configure.
For agencies and freelancers, create individual accounts instead of sharing one administrator login. When the relationship ends, revoke that account without forcing everyone else to change credentials.
Keep recovery codes somewhere safe
MFA recovery codes should not live only on the device that provides the second factor. Store them securely in your password manager or another protected location you can access during a lost-phone or device failure scenario.
Do not use security questions as a substitute
NIST’s current guidance also rejects knowledge-based authentication questions such as a first pet or birthplace for password setup. Those answers can be guessable, discoverable or reused.
Prefer proper recovery methods provided by the service.
A practical security checklist
- Use a password manager.
- Use a different long password for every important service.
- Enable MFA on email, domain, hosting and WordPress admin accounts.
- Change passwords after compromise or access changes, not on an arbitrary calendar.
- Remove unused accounts.
- Use least-privilege WordPress roles.
- Store recovery codes securely.
- Review recovery email and phone details periodically.
The practical rule
Password security is a system, not a rotation schedule. Make credentials unique, protect the accounts that control recovery, add a second factor and change passwords when there is a real reason. That is more useful than repeatedly replacing a strong password with a predictable variation.
Official reference: NIST SP 800-63B Digital Identity Guidelines.