Moatline

Unknown admin user in WordPress? How to check it, remove it and lock the door

An administrator account you didn’t create is one of the clearest signs of a hacked WordPress site. Before you delete it, check whether it is really an intruder, look for hidden ones, and find what created it.

By the Moatline team at Next Nova Technologies · Published 15 October 2026 · 4 min read

Is it really an attacker?

Some unfamiliar admin accounts are legitimate. Before deleting, rule these out:

  • Another admin, your developer or your agency added it. Ask them.
  • Your host added a support account. Some managed hosts do this automatically, for example WP Engine’s “wpengine” user.
  • A plugin’s support team was given temporary access and the account was never removed.

Signs it is an attacker: nobody can explain it, the email address is random or on a free mail service, it was registered around the time problems started, or it has a name chosen to look official (“wpadmin”, “support2”, “siteadmin”).

Find hidden admin users

Go to Users and click Administrator above the list. Compare the number in brackets with the number of rows shown. If it says Administrator (3) but you can only see two, an account is being hidden from you.

With SSH, this lists every administrator with plugins and themes switched off, so hiding code can’t interfere:

wp user list --role=administrator --skip-plugins --skip-themes \
  --fields=ID,user_login,user_email,user_registered

Without SSH, run this in phpMyAdmin (change wp_ if your table prefix is different):

SELECT u.ID, u.user_login, u.user_email, u.user_registered
FROM wp_users u
JOIN wp_usermeta m ON m.user_id = u.ID
WHERE m.meta_key = 'wp_capabilities'
  AND m.meta_value LIKE '%administrator%';

Also check Settings → General. If “Anyone can register” is ticked and the default role is Administrator, an attacker changed it so anyone can sign up as an admin. Set it back to Subscriber, and untick registration if you don’t need it.

Remove it safely

  1. Back up files and database first.
  2. Note the details (username, email, registration date). The date tells you roughly when the attacker got in.
  3. Delete the user under Users, and when asked, give their content to your own account. Then review that content and delete any spam. With SSH: wp user delete ID --reassign=YOUR_ID.
  4. Check application passwords. Open each real admin’s profile and scroll to Application Passwords. Revoke any you didn’t create: they let someone log in without the normal password.

If it keeps coming back

If the account reappears after you delete it, code on the site is recreating it. Look for:

  • Must-use plugins in wp-content/mu-plugins. They run automatically and don’t show in the normal Plugins list.
  • Fake plugins with official-sounding names you never installed.
  • Theme files, especially functions.php.
  • PHP files in the uploads folder. WordPress never puts code there.

With SSH, this finds files that create users, which few legitimate plugins need to do:

grep -rlE "wp_(create|insert)_user" wp-content --include=*.php

Some results will be normal (membership, shop and form plugins create customer accounts). Look closely at anything in mu-plugins, uploads, your theme or a plugin you don’t recognise.

The free Moatline Malware Scanner finds fake plugins, must-use plugin backdoors and PHP in uploads, and flags a few admin usernames known from past attacks. It can’t know which of your own admins are genuine, so the review above is still needed.

Lock the door

  1. Change every password: all WordPress admins, hosting, FTP and database.
  2. Generate new security keys in wp-config.php, which logs everyone out, including the attacker.
  3. Turn on two-step login for every admin, so a stolen password alone isn’t enough. Moatline includes it free.
  4. Find how they got in. Usually an outdated plugin (for example the recent Bricksforge and form plugin attacks) or a reused password. Update everything and remove what you don’t use.
  5. Scan for anything else they left. An attacker with admin access can install plugins and edit files. Our malware removal guide covers a full cleanup.

Frequently asked questions

Can malware hide an admin user from the Users list?
Yes. Some malware filters the Users screen so its account never appears in the list, even though the count above the list still includes it. Checking with WP-CLI with plugins and themes switched off, or with a database query, shows every account.
Should I delete the user’s posts too?
When WordPress asks what to do with the user’s content, choose to give it to your own account, then review it. Attackers sometimes publish spam posts or pages under their account, and those should be deleted after you have looked at them.
The admin has a normal-looking name like “wpsupport”. Is it safe?
Attackers pick names that look official: support, admin2, wpadmin, techsupport, or your own name with a number. The name means nothing. What matters is whether you, your developer or your host can explain where the account came from.
Is changing my password enough?
No. An attacker with their own admin account doesn’t need your password. Remove their account, check application passwords and backdoor files, and only then change passwords and security keys so any stolen login stops working.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →