Yes. After a security incident, you should change every password associated with your website, including WordPress administrator accounts, hosting accounts, FTP or SFTP credentials, databases, email accounts, and any connected services. Strong, unique passwords combined with Multi-Factor Authentication (MFA) provide significantly better protection.
