Glossary · Login
A user has an easily guessed password
- Wordfence type
easyPassword- Category
- Login
- Severity
- High for administrators, lower otherwise
Wordfence tested account passwords against common and breached password lists and one matched.
User "admin" with "Administrator" access has an easy password.
What Wordfence found
The password audit hashes candidate passwords from known-weak and breached lists and compares them against the stored hashes. A match means that account's password is one an attacker will try early.
Why it matters
Credential stuffing does not need a vulnerability. If the password is in a public list, the account is effectively open, and an administrator account is a complete compromise. The severity depends almost entirely on the role.
How to fix it
- 1Force a password reset for the affected account rather than emailing them a suggestion.
- 2Turn on two-factor authentication for every administrator and editor. This is the single highest-value change on the list.
- 3Set a password policy that rejects breached passwords at the point of change.
- 4Review whether the account needs its current role at all — most people given administrator do not need it.
Common questions
- How does Wordfence know the password is weak without knowing the password?
- It hashes candidates from breached-password lists with your site's own salt and compares the result against the stored hash. A match proves the account's password is on a public list — the same lists credential-stuffing bots run. Nothing was decrypted; the password was simply common enough to be guessed.
- The flagged account is an administrator. How bad is that?
- It is the finding to fix today. Admin access is full compromise-on-login: file editing, plugin installation, user creation. Bots test breached passwords against wp-login.php continuously on every WordPress site on the internet — a listed password on an admin account is not a risk of compromise, it is a countdown.
- Beyond changing this one password, what should follow?
- Force a reset if the account is not yours to change, enable two-factor authentication for administrators (Wordfence includes it), and check the account's recent activity if the password has been weak for long. Consider whether other accounts share the pattern — one weak password on a site is usually not the only one.
Findings that often appear with this one
- An administrator was created outside WordPress Login
- wp-config.php is readable over the web Public files
How WPSecureOps treats it
The connector reports this as easyPassword. WPSecureOps files it under
Login and bands it by the numeric severity Wordfence
assigns, so findings of this kind from every site you manage arrive in one queue rather
than one email per site. Titles and descriptions are stripped of HTML and the site's
absolute path is replaced before anything leaves the server.
Primary references
Product behaviour and remediation guidance were checked against these primary sources.