adminCredential Key and Token Rotation Checklist After Security Incident
After a security incident, cleaning files is not enough. Passwords, SSH keys, database credentials, API keys, webhook secrets and service tokens may be exposed. Rotation reduces the chance that old access can be reused.
Core principle
Assume credentials touched by the compromised system may be unsafe. Rotate from a clean device and update dependent services carefully.
Checklist
- List all credentials used by the system.
- Prioritize hosting, VPS and WordPress admin credentials.
- Rotate SSH keys if compromise is suspected.
- Rotate database passwords.
- Rotate API keys and service tokens.
- Rotate webhook secrets.
- Update .env files and application configs.
- Restart affected services.
- Remove old keys from providers.
- Verify all workflows still work after rotation.
Reusable lesson
Credential rotation applies to WordPress, VPS, GitHub, Cloudflare, email SMTP, analytics, payment tools, AI APIs, n8n and automation pipelines.
When to Use This Checklist
Use this checklist after suspected compromise, leaked keys, unknown admin access, exposed .env files or hacked automation workflows.
Required Tools
Password manager, clean device, hosting panel, SSH keys, database access, API provider dashboards, .env files
Before You Start
Rotate credentials from a clean device. Do not trust a compromised machine for sensitive password changes.
Structured Checklist Steps
- List credentials.
- Rotate hosting and VPS credentials.
- Rotate WordPress admin passwords.
- Rotate SSH keys if needed.
- Rotate database passwords.
- Rotate API keys.
- Rotate webhook secrets.
- Update configs.
- Remove old keys.
- Verify workflows.
Verification Steps
- Old credentials no longer work.
- Applications use new credentials.
- Services restart successfully.
- Automation workflows still run.
- Credential inventory is updated.
Rollback Plan
If rotation breaks an application, restore access using the new credential in the correct config file rather than re-enabling the old compromised credential.
Common Mistakes
- Changing only one password.
- Forgetting database credentials.
- Leaving old API keys active.
- Not updating .env files.
- No credential inventory.
Related Commands
grep -R "API_KEY" .
grep -R "DB_PASSWORD" .
grep DB_ wp-config.php
docker compose config
sudo systemctl restart nginx
docker compose restart