Unknown administrator user in WordPress

An unknown WordPress administrator is an account with the Administrator role that you did not create and cannot match to a current person. It might be a forgotten developer, a host login, or a sign that someone else can change the site. Identify the account before you delete it, and check passwords and files if nobody can explain it.

What you are seeing

Under Users, the Administrator filter shows a login you do not know. The email may be a free mailbox, a near-miss of your domain, or a company you never hired. The registration date may be recent, or old and simply unnoticed. Sometimes you notice because a post changed, a plugin appeared, or the host said the site was altered.

The login, email, and date are on the users table, usually wp_users. The role lives in usermeta, often under wp_capabilities. If your prefix is not wp_, the names follow that prefix. The Users screen is enough if you can log in.

This page is about administrators, because that role can install code and create more administrators.

Why it happens

A forgotten freelancer, a host login from an old ticket, a staging copy, or a form plugin set to create administrators can all explain the account. None of that requires bad intent. Remove it anyway if that person no longer works on the site.

The other case is a second account created so access survives your password change. If the user comes back after you delete it, a file or a still-valid password is creating it. Check PHP in uploads and wp-content/mu-plugins. See how access usually starts.

Judge the email, the date, and whether a person you trust claims the account. A login named admin proves nothing by itself.

How to check if you are affected

The scanner below is read-only and does not log into wp-admin, so it cannot list users. Use it for public signs, then open Users yourself. An unknown admin can sit on a site that looks normal from the outside.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

1. Filter Users by Administrator. Write down the login, email, and registration date for each one.
2. Ask anyone who has worked on the site, and the host if a ticket is open, whether they recognize it. Give them the email.
3. If you use a membership or user-import plugin, see whether it can create administrators from a public form.
4. Sort posts by modified date and look at plugins you do not remember. An unused stranger account is still a problem. One that installed software is a larger one.
5. Over SFTP, look in wp-content/mu-plugins and wp-content/uploads for PHP you did not add. Compare the active theme's functions.php with a clean copy.
6. If you cannot log in as any known administrator, stop guessing passwords. Use the host's reset tool, or the lost-password email if it reaches a mailbox you control. WordPress.org documents a reset when email is dead. Do not invent a password hash in the database.

Also look for an email domain that imitates yours.

How to fix it yourself

1. Isolate the site if you also see spam, a redirect, or files you did not add. An unexplained user alone does not always require downtime. A user plus unwanted files does.
2. Back up files and export the database before you delete anyone. WordPress will ask what to do with that user's posts. Attribute real posts to you. Delete spam posts with the user, after the backup exists.
3. Confirm an administrator you control, with an inbox you can open today. Then remove or demote the unknown administrator. Do not delete your own account or the last administrator.
4. If a current developer still needs access, replace the account by agreement. If they no longer work for you and do not answer, remove it.
5. Replace core from wordpress.org if anything else looks changed: fresh wp-admin, wp-includes, and root PHP files, same wp-config.php. If the only issue was a forgotten freelancer and the files match a clean copy, you may not need that replace. If you are unsure they match, replace core.
6. Reinstall plugins and themes from clean copies when files differ, or when the stranger had time to write to disk.
7. Reset every remaining administrator password, plus SFTP, the hosting panel, and the database password. Update DB_PASSWORD in wp-config.php if needed. Replace salts from the official salt generator so old sessions end.
8. Remove PHP from wp-content/uploads and ask the host to refuse to run PHP there.

DIY is a bad idea with no backup, if the user reappears, if the host has suspended the account, or if you are logged in only as the unknown account. Get a reset from the host before you lock yourself out. See how to clean a hacked WordPress site.

When to get help

Get help when the administrator comes back, when you do not recognize what they could have installed, when you cannot log in as someone you trust, or when the user is tangled up with spam you are afraid to delete. A single forgotten designer account, confirmed by that person and then removed, is something you can finish yourself.

Emergency Cleanup is a flat $499. The 30-day reinfection guarantee means we clean the site again, or we refund the fee if we cannot clean it. We work only after you confirm you own the site. That includes not removing users on a site you do not own. No countdown. Email daniel@daniellasek.com or continue below.

Fix it now — $499 Talk to us by email

FAQ

Could an unknown WordPress administrator be my developer or my host?

Yes. Ask them before you assume the worst. Check the email address and the registration date on the Users screen. A support login you were told about is different from a new administrator with an unrelated email.

I deleted the unknown admin and the account came back. What does that mean?

Something on the site can still create users, or someone still has a password. Removing the row is not the whole job. Reset passwords, replace changed plugins and themes, and look for PHP files you did not add.

Should I delete every WordPress user who is not me?

No. Authors, editors, shop managers, and customers may be legitimate. Start with the administrator role. Remove or downgrade only accounts nobody can explain.

Is changing my own WordPress password enough?

No. Change every administrator password, the hosting and SFTP passwords, and the secret keys in wp-config.php. One new WordPress password leaves the other doors as they were.