DreamHost began resetting passwords for some email and FTP/SFTP users on 23 October 2026, after what its status page calls an incident. The people affected cannot sign in until the DreamHost account owner sets a new password and hands it over. The File Manager came back online on 26 October. When we read the page on 27 October, it still listed Email Hosting, Webmail and File Manager as a service disruption.
DreamHost describes the resets as a precaution, and the cause is its to explain. So the useful questions are practical ones: what these logins open, what the owner must change, and which of your own tools break when a host resets credentials.
Last updated: 27 October 2026. We update this page if DreamHost revises its notices.
What to Change Today if You Host With DreamHost
If you own the DreamHost account, you can act now. DreamHost says you do not have to wait for its email, and that a new password can take up to 15 minutes to take effect. The order below is deliberate: reset the logins first, check forwards next because they outlast a reset, then update the tools that stored old passwords.
- Open the panel yourselfType panel.dreamhost.com into the browser. DreamHost says it will never email you asking for your password.
- Reset every mail passwordGo to Mail, then Manage Email, and set a new password for each address.
- Reset every FTP/SFTP passwordGo to Websites, then SFTP Users and Files, and set a new password for each user.
- Review mail forwardsOn each address, remove any forward you do not recognize or no longer use.
- Update every stored copyMail apps, SFTP clients, backup and deploy tools and plugins keep the old password until you change it.
- Pass the new details on privatelyUse a phone call or secure text. Users cannot open their DreamHost inbox until they have the new password.
The forwards check matters for any mailbox. A forwarding rule copies mail to another address, and MITRE ATT&CK notes that such rules can keep access to someone’s mail even after the credentials are reset (technique T1114.003). DreamHost’s status notification page asks owners to review forwards while they are changing passwords.
What DreamHost Has Published So Far
DreamHost prints its times in Pacific time. These are the main updates from its status page, oldest first.
- 23 Oct, 2:20 PMFile Manager connectivity issueThe operations team investigates connectivity issues affecting the File Manager.
- 23 Oct, 5:20 PMIncident across several servicesThe File Manager is offline and some webmail users are signed out. DreamHost resets the passwords of some email accounts as a precaution.
- 23 Oct, 10:13 PMFTP/SFTP joins the resetsDreamHost reports an issue with some systems, including FTP/SFTP access and webmail, and resets passwords for some email and FTP/SFTP users.
- 24 Oct, 10:37 AMResets completeAccount owners can set new passwords in the panel now. Emails with steps go out in batches.
- 25 Oct, 9:32 PMAll affected owners emailedEmail and FTP users cannot sign in until the owner resets their passwords and shares the new ones.
- 26 Oct, 3:35 PMFile Manager backA fix is out and DreamHost is monitoring. Password resets are still required for a subset of accounts.
Two details change what an owner should do. On the night of 23 October (10:13 PM), and again at 12:25 AM on 24 October, DreamHost asked owners to wait for its email, because changes made before the reset was complete would be overwritten. At 10:37 AM on 24 October it said the reset was complete and owners need not wait. Anyone who set a password before that notice should check that it still works.
What a Hosting Login Opens, and Why It Is a Third-Party Risk
A mail login at your host is a mailbox, and other services often send their password-reset links to a mailbox like it. An FTP/SFTP login lets someone read and change the files of a website. On WordPress that includes themes and plugins.
Only the account owner, or a panel user the owner has given privileges, can change them. DreamHost’s help center says users without panel access should ask the owner. That is why employees, clients and family members stayed locked out until the owner passed new details on.
This is a third-party risk in its plainest form. Your host sits inside your own trust chain, and its credential decisions reach you with no change on your side. The breakage can show up in tools, not people: a backup plugin that copies files over SFTP, a WordPress mail plugin that sends through a hosted mailbox, a deploy job, or the mail app on a phone. Each of them stored the old password and will fail until someone updates it.
How to Check a WordPress Site on DreamHost
DreamHost’s notices name only mail and FTP/SFTP users, and do not report any changed site file or mail forward. The checks below are routine precautions.
WordPress administrator logins and database passwords are separate credentials. The status page shows Database Hosting and DreamPress Hosting as operational. That describes whether those services are running, and it says nothing about those credentials.
An SFTP login can change site files, so a password reset is a good moment for the routine file check every site owner should run. Look for new or edited PHP files in the uploads and plugin folders, administrator accounts you did not create and scheduled tasks you do not recognize. An unexpected PHP file is how a web shell usually appears. A backup or security plugin with a file-change view makes this quick.
Then add your host to your third-party risk management list. Write down what it holds for you (mail, files, deploy access) and who to call. The UK NCSC supply chain security guidance is a ready frame for that list.
Turn on multi-factor authentication wherever your providers offer it. CISA’s MFA page explains why a password alone is not enough. Keep a recovery route for your domain that does not depend on one hosted mailbox. DreamHost’s status page also offers updates by RSS, Slack and iCalendar, which is worth subscribing to.