How to Check WordPress for Hidden Admin Accounts

How to Check WordPress for Hidden Admin Accounts

Hidden administrator accounts are a common sign of a compromised WordPress site.

This guide shows how to inspect user records, spot suspicious privileges, and remove unauthorized access without breaking a legitimate installation.

Why hidden admin accounts matter

A WordPress admin account has the highest level of access on a standard site.

If an attacker creates or conceals one, they can change plugins, install malware, edit theme files, add redirects, or lock out real site owners.

Hidden admin access is especially risky because the account may be easy to miss in the dashboard, appear under a different role, or be created through a plugin, database edit, or compromised hosting account.

WordPress security specialists often look for unauthorized administrators alongside other indicators such as malicious code in wp-config.php, unfamiliar plugins, and recent file changes.

How to check WordPress for hidden admin accounts?

The safest approach is to verify users in both the WordPress dashboard and the database, then compare those results with expected site administrators.

A single check is not enough because attackers can sometimes alter the display layer, hide users with custom code, or create accounts directly in the database.

1. Review all users in the WordPress dashboard

Start in Users > All Users and look closely at every account.

Confirm that each administrator is known, active, and required for site operations.

• Check usernames for suspicious patterns, random strings, or look-alike names.
• Open each admin profile and verify the email address, display name, and role.
• Look for accounts with recent creation dates that you do not recognize.
• Watch for accounts that were added after a plugin install, theme change, or login incident.

If you manage a team, compare the list against your actual staff, contractors, and agencies.

Hidden accounts are often disguised with names that look legitimate at a glance.

2. Confirm the admin list in the database

The WordPress database is the authoritative source for user and role data.

Using phpMyAdmin, Adminer, or your host’s database tool, inspect the wp_users and wp_usermeta tables.

The table prefix may differ from wp_, so use your site’s actual prefix.

Focus on these fields:

• wp_users.user_login for the login name
• wp_users.user_email for the account email
• wp_users.user_registered for creation date
• wp_usermeta.meta_key entries that define capabilities and user level

Look for wp_capabilities values that include administrator.

If you see an account with administrator privileges that does not appear in your normal workflow, treat it as suspicious.

3. Search for accounts created by plugins or code

Some security incidents involve a backdoor account created by malicious code in a plugin, theme, or must-use plugin.

Review recently modified files in wp-content/plugins, wp-content/themes, and wp-content/mu-plugins.

Pay special attention to code that calls functions such as wp_create_user(), wp_insert_user(), or add_role().

Also inspect custom snippets added through tools like Code Snippets or site-specific plugins.

Attackers may use these locations to recreate admin access after cleanup.

4. Look for hidden or filtered users

Some malware hides users by filtering the admin list or modifying queries.

If a dashboard view seems incomplete, test from another admin account, use a different browser, or query the database directly.

A user hidden from the dashboard can still exist in the database with full privileges.

You can also search for accounts with unusual metadata, such as multiple roles, unexpected capabilities, or strange serialization patterns in wp_usermeta.

If a user exists but is not visible normally, assume the site has been tampered with until proven otherwise.

5. Check for suspicious login activity

Review login logs if you have a security plugin or host-level audit trail.

Tools such as Wordfence, Sucuri, iThemes Security, and activity log plugins can show IP addresses, timestamps, and failed login attempts.

• Unknown IP addresses logging in as admin.
• Successful logins at unusual hours.
• New administrator accounts created shortly after repeated failed attempts.
• Logins from countries or networks unrelated to your team.

If no logging exists, consider adding it after cleanup.

Audit logs make it easier to confirm whether a suspicious account is active or dormant.

Signs an admin account may be malicious

Not every unfamiliar administrator is an attack, but several signals raise concern.

One suspicious item may justify more review; multiple signals usually mean you should act quickly.

• The account was created without authorization.
• The username mimics a real employee, such as a slight spelling change.
• The email domain is unrelated to your organization.
• The role changes unexpectedly from subscriber or editor to administrator.
• The account is tied to a plugin you do not trust.
• The user has not been seen in internal records, support tickets, or onboarding notes.

What to do if you find a hidden admin account

Do not delete the account immediately if you still need evidence or if the attacker may have planted multiple access paths.

First, secure the site, record what you found, and identify how the account was created.

1. Change all administrator passwords, hosting passwords, and database credentials.
2. Rotate WordPress salts in wp-config.php to invalidate sessions.
3. Remove the unauthorized account after exporting evidence such as username, email, dates, and IP logs.
4. Scan core files, plugins, themes, and uploads for malicious code.
5. Update WordPress core, plugins, and themes from trusted sources.
6. Reinstall clean copies of any suspicious plugins or themes.

If the compromise is serious, restore from a known-clean backup and compare the backup against the current site before putting it back online.

In some cases, a full incident response review is the most efficient way to eliminate persistence.

How to prevent hidden admin accounts in the future

Prevention is mostly about limiting access, improving visibility, and reducing the chance that a malicious user can persist unnoticed.

WordPress itself is secure when maintained correctly, but weak passwords, outdated plugins, and excessive admin privileges create openings.

• Use two-factor authentication for all administrator accounts.
• Keep the number of administrators as low as possible.
• Assign editor or author roles instead of admin when full access is not required.
• Remove unused accounts immediately.
• Install a reputable activity log or security plugin.
• Back up the site regularly and test restore procedures.
• Limit file editing in the dashboard by setting DISALLOW_FILE_EDIT to true.

It also helps to review user access after staff changes, agency transitions, and plugin updates.

Administrative sprawl is one of the easiest ways a hidden account goes unnoticed.

Useful tools for checking WordPress users

Several tools can make account audits faster and more accurate.

Choose tools from reputable vendors and verify that they are updated, actively maintained, and compatible with your WordPress version.

• Wordfence for firewall, malware scanning, and login monitoring.
• Sucuri Security for integrity checks and audit features.
• WP Activity Log for detailed user and content events.
• phpMyAdmin or Adminer for direct database inspection.
• WP-CLI for command-line user audits on managed servers.

WP-CLI can be especially useful on larger sites because it lets you list users quickly and compare roles without relying on the dashboard.

That is helpful when the admin interface itself may be compromised.

When to involve your host or a security professional

If you find multiple unknown admin accounts, repeated reinfection, or signs of database tampering, involve your hosting provider and a WordPress security expert.

A compromised server, stolen FTP credentials, or a vulnerable plugin can make cleanup harder than a normal account removal.

Request access logs, file modification logs, and any available backups from your host.

Those records can reveal the original entry point and help confirm whether the hidden account was created manually, through malware, or through an exposed credential.