DreamHost Password Reset: Owners Can Act Without Waiting for Email
DreamHost’s October 24, 2026, 6:09 p.m. PDT incident update says affected account owners can set new email and FTP/SFTP passwords without waiting for its notification email. The notice concerns an incident affecting File Manager and Webmail. Its earlier instruction to wait has been superseded by the later update.
Go directly to panel.dreamhost.com. The notice directs owners to Mail > Manage Email or Websites > SFTP Users & Files and allows up to 15 minutes for a new password to take effect. Email or FTP users without owner access should contact their account owner. DreamHost says this notification will not ask for a password or ask recipients to log in through an email link.
DreamHost’s incident timeline and updated instructions
Identify the login that needs changing
DreamHost documents separate password types for mail, website, MySQL, panel and application users. Write down the affected username and service before changing anything. A password that opens the hosting control panel is not automatically the password used by a mailbox or a website’s file-transfer user.
The password overview recommends unique passwords and a password-management tool. Reusing one new password across several user types would recreate a shared dependency between them. Keep the new credential in your password manager and avoid sending it through ordinary email.
DreamHost password types, guidelines and troubleshooting
For a mailbox, use Manage Email
DreamHost’s mail-user guide says an owner or appropriately privileged panel user can create a new mailbox password if the existing one is lost. Without panel access, contact the account owner. The guide says this cannot be done within Webmail itself.
In Manage Email, locate the address, choose Manage, then use Change Password. Generate a strong password or enter your chosen new one and save the change. After the incident’s stated propagation allowance, update the saved credential in the mail clients using that mailbox and check access. Record which clients you updated so an old stored password is easier to identify.
Official mail-user password procedure
For file access, choose the website user
The website-user guide covers SFTP and Shell users with access to website files. It explicitly distinguishes these from CMS logins such as WordPress. Changing a WordPress administrator password therefore does not perform the website-user password change described here.
Open SFTP Users & Files, choose the relevant user’s Login info, select Change password, then generate or enter the replacement and select Reset Password. Confirm the success message. For this incident, follow the longer propagation allowance in the incident notice before concluding that a new credential failed.
Official website-user password procedure
Panel MFA and mailbox access are separate
DreamHost’s MFA documentation describes an additional one-time passcode for control-panel access. It also explicitly says the DreamHost email service does not support MFA. Enabling a second factor for the panel should not be presented as enabling it for every mailbox.
The panel’s Security page separately offers panel password changes, MFA and active-session review. Its Active Sessions section lists login IP addresses and allows other sessions to be ended. Review those controls in the context of your own account rather than assuming a mail-password change also updates the panel login.
Panel security controls and active sessions
Choose the correct recovery step
Keep the incident timeline open while recovering access, because instructions can change. Match each action to its username and service, allow the stated update time, and use official support if access still fails. A completed password change is a recovery step, not proof that every affected service has been restored.