What to change.
WHAT TO CHANGE
Hosting account password Site administrator passwords, all of them Database password, updating the configuration file FTP account passwords Email account passwords API keys and integration credentials Registrar password
ALL OF THEM
Not just the one you think was used.
FROM A CLEAN COMPUTER
If your machine may be compromised, changing passwords from it is pointless.
THE DATABASE PASSWORD
Change it in cPanel and update your site's configuration file.
Both, or the site breaks.
API KEYS
Payment gateways, email services, anything integrated.
Regenerate them.
SECURITY KEYS
WordPress has authentication keys in its configuration.
Changing them invalidates existing sessions, logging out anyone still connected.
Do that.
WHAT ELSE
Remove any user account you did not create Remove any SSH key you did not add
WHAT TO DO AFTERWARDS
Enable two-factor authentication everywhere.
