In principle, just resetting the password, plus invoke the “Log out everywhere else” on the user profile, should be enough to prevent benign user knowing the password. Reset the web host customer password, including any associated FTP account password. Use strong and unique passwords.
But, in case any unknown, possibly malicious user, may have had wp-admin, hosting account or FTP access, a backdoor may have been introduced through PHP code. In that case the site must be regarded hacked. See https://wordpress.org/support/article/faq-my-site-was-hacked/
Any custom PHP code should be reviewed to rule out a backdoor, plus wp itself and all plugins/themes reinstalled from scratch. This is not trivial, requiring an expert.
Related Posts:
- Create un-removeable user
- Is there a way to have admins that are logged in to wordpress not have to enter the password for password protected pages while browsing the website?
- Two admins in Users and one in the database?
- When admin changes a password for a registered user, I don’t want to send a password change email to users
- How to change the User name and Password of admin account
- What are the standard admin CSS id/class tags?
- Admin Ajax is returning 0
- Add custom column to Users admin panel
- wp_verify_nonce vs check_admin_referer
- Add a Separator to the Admin Menu?
- How to determine whether we are in add New page/post/CPT or in edit page/post/CPT in wordpress admin?
- how to know if admin is in edit page or post [duplicate]
- Modal window from within WordPress admin
- Where in WP can I check history or log of updates of plugins etc?
- Adding a custom admin page
- How does admin-ajax.php work?
- How to remove entire admin menu?
- How do I remove dashboard access from specific user roles?
- Disable user registration password email
- How can I speed up my WP admin section?
- How to pass parameters to admin_notices?
- Admin: very slow edit page caused by core meta query
- if admin is logged in
- wordpress redirect after password reset
- Check for correct username on custom login form
- Search posts by ID in admin
- How to Change the Default Home Page for the WordPress Dashboard?
- Setting admin edit panels & metaboxes positions and visibility for ALL users and admins
- Find out which moderator approved comment?
- The website cannot display the page
- How To Remove WordPress Version From The Admin Footer
- Sort pages in loop by admin’s page attributes order field?
- Edit “thank you for creating with WordPress” in version 3.3.1
- Hide other users’ posts in admin panel
- Set Default Admin Colour For All Users
- Editor Styles and Typekit
- WordPress admin stylesheet
- Missing URL in password reset email
- This CSS Stuffing Works, But Is This A Good Practice?
- Is it possible to create a WordPress tour? V3.3.1
- Securing Admin Accounts – Username Discovery
- is_admin() returns true when using admin-ajax.php from front end script
- How to save dismissable notice state in WP 4.2?
- How do I optimize a custom post type admin page with 25,000 posts?
- Settings API – adding setting fields dynamically?
- Disable Media Uploads to non Admin Users
- How do I create a password reset link?
- How do I load a CSS style into WordPress admin area only?
- Allowing admin-ajax.php to receive “application/json” instead of “x-www-form-urlencoded”
- Can an admin check passwords of registered users?
- How can I target WordPress 3.8 new interface MP6 with CSS?
- Notification that the admin is online
- Does wordpress create activity, update logs?
- sort child pages on admin
- How-to make the admin area mobile friendly [closed]
- How to remove list view from media library?
- How to disable the “Your site has updated to WordPress x.y.z” admin email?
- Load plugin scripts and styles only on plugin page
- Plugin to remove Admin menu items based on user role?
- How to obtain the user ID of the current profile being edited in WP-Admin?
- 3.3: How do you hide the new dashboard welcome panel?
- Add my own button next to “Screen options” and “Help” in the admin
- WP List Table custom quick edit box – post meta data missing and columns change on submit
- Settings API – easiest way of validating checkboxes?
- Are there any action like ‘init_frontend’
- Should I use is_admin() inside ‘admin_init’ hook callback
- Custom admin email for new user registration
- Send Admin Emails to Multiple Email Addresses
- How do I set up the defualt page icon for admin menu?
- Prevent author from changing their posts if admin has modified
- Cannot access admin panel
- Make A WordPress Page Accessible To Admins Only, Redirect Other User Roles
- Disable all https in WordPress
- localhost/wp-admin on my local redirects to production site’s /wp-admin
- How to remove administrator role in settings -> general -> New User Default Role?
- Is there a more efficient admin search function/plugin?
- Can a users profile be put under the dashboard menu
- WordPress Admins or Roles per Page
- Styling Shortcodes in Visual Editor
- initial sort order for a sortable custom column in admin
- Showing WP_Error message with admin_notice action hook
- WordPress admin screen very slow / timing out when editing or adding a new page/custom post
- Uploading files in admin panel?
- turn off new user registration emails
- Redirect Admin User in Dashboard
- Send automatic mail to Admin when user/member changes/adds profile
- Get current active wp color scheme
- Read only capability for custom post in admin area
- WordPress Admin back-end – advanced options page?
- Cannot login to WordPress Admin with SSL terminated load balancer
- How can ‘admin_email’ be set?
- Set Featured Image programmatically (in admin) with JavaScript?
- Disable the post save process completely
- use add_settings_field properly?
- How to change WordPress default strings?
- How can we customize the logo and some text on the welcome screen?
- front end logo upload like happytables
- Can I set a default dashboard layout for all users?
- Allow admin login at /admin
- Is there a hook to put stylesheet and/or JS inside iframes (thickbox or tinyMCE) in admin area