---
title: "Update WordPress administrator password"
method: POST
path: "/WPX/change_admin_password"
tags: ["WPX"]
---

# Update WordPress administrator password

`POST /WPX/change_admin_password`

## Request

- Base URL: `https://cpanel-server.tld:2083/execute`
- URL: `https://cpanel-server.tld:2083/execute/WPX/change_admin_password`
- Auth: HTTP basic

This function sets a new password for a WordPress administrator of an
installation that the caller owns.

  **Note:**

  - Over HTTP this function accepts only the `POST` method, and it rejects
    any request that carries a `password` key in the URL query string. It
    checks both before it reads the password, so the password cannot reach
    an access log, a proxy log, or the browser history. The Perl bindings
    and the `uapi` command-line tool set no request method and no query
    string, so they are unaffected.
  - The system passes the password to WordPress through a file that only the
    caller can read, so it never appears in a process list, in the process
    environment, or in the WordPress Toolkit logs.
  - The system applies no password-strength rule of its own. Any non-empty
    value is accepted.
  - The system verifies that the caller owns the installation before it
    changes anything.

## Request body `application/x-www-form-urlencoded`

- object
  - `id` integer, required: The WordPress Toolkit installation id, as returned in the `wptk_id` field of `list_websites`.
  - `login` string: The WordPress administrator login to change. Omit this parameter only when the installation has exactly one administrator, and the system targets that administrator. When supplied, it must name an existing administrator of that installation. Call `get_admin_account` to list the available logins.
  - `password` string, required: The new WordPress administrator password. Send this parameter in the request body. The system rejects the call when a `password` key appears in the URL query string.

## Response `200`

The HTTP request was successful.

- object
  - `apiversion` integer: The version of the API.
  - `func` string: The name of the method called.
  - `module` string: The name of the module called.
  - `result` object
    - `data` object: Confirmation of the change, and the administrator it applied to.
      - `changed` 1: Always `1`. A failure returns a failure status with a message in the `errors` field instead.
      - `id` integer: The installation id that the system changed.
      - `login` string: The WordPress administrator login whose password changed. This is useful when you omit the `login` parameter.
    - `errors` string[], nullable: List of errors if the API failed.
    - `messages` string[], nullable: List of messages generated by the API.
    - `metadata` object
      - `transformed` 1: Post-processing may have transformed the data.
    - `status` 1 | 0: - `1` - Success. - `0` - Failed: Check the errors field for more details.
    - `warnings` string[], nullable: List of warnings generated by the API. Warnings describe non-critical failures or other problematic conditions noted while running an API.

## Changes

- **2026-09-23** `aed66b1a51cc`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/cpanel/apis/cpanel-uapi/changes/WPX/change_admin_password/post.md)

---

[API](https://skmtc.dev/cpanel/apis/cpanel-uapi.md) - [All operations](https://skmtc.dev/cpanel/apis/cpanel-uapi/llms.txt) - [OpenAPI document](https://skmtc.dev/cpanel/apis/cpanel-uapi/revisions/05239220da37?raw)