How To Check WordPress Users After A Hack: Find Suspicious Accounts And Secure Your Site

How to Check WordPress Users After a Hack

If your WordPress site has been compromised, one of the first things to inspect is the user list.

Attackers often create administrator accounts, modify roles, or hide behind legitimate-looking usernames, so a careful review can reveal how they stayed in control.

This guide explains how to check WordPress users after hack activity, what suspicious patterns to look for, and how to confirm whether an account is legitimate before you remove or reset it.

Start with the WordPress Users screen

Focus on usernames, display names, email addresses, roles, and registration dates, because attackers often rely on overlooked details rather than obvious malware alone.

Username: Look for unfamiliar names, random strings, or names that mimic real staff.

Email address: Check for free mail providers, strange domains, or addresses unrelated to your organization.
Role: Pay special attention to accounts with Administrator, Editor, or custom elevated roles.
Registration date: Newly created accounts around the time of the incident deserve immediate review.

If your site has many users, sort or filter by role first.

Attackers usually escalate privileges because administrator access gives them the ability to install plugins, edit files, or create more accounts.

Look for suspicious account patterns

A compromised WordPress site rarely has just one obvious indicator.

Instead, suspicious users often share behavioral or profile patterns that stand out when compared with legitimate accounts.

Common red flags in WordPress user accounts

Accounts created during unusual hours or shortly before malicious changes were found.
Administrators that were never approved by the site owner or agency.

Users with no profile picture, no bio, and generic display names.
Accounts using usernames such as admin2, test, support, or random character strings.
Users who appear in the database but not in any internal onboarding records.

Multiple accounts sharing similar email patterns or minor spelling variations.

Attackers also sometimes clone the name of a real employee while using a different email address.

For example, a fake account may use a display name that matches a known editor, but the email domain and registration timestamp tell a different story.

Verify each account against trusted records

Checking whether a user is suspicious is easier when you compare WordPress data with trusted records from your team, hosting provider, or identity system.

The goal is to confirm whether the account was intentionally added.

Use these sources to verify accounts:

Internal onboarding records: Confirm whether the user was ever approved.

Email archives: Search for account creation requests or welcome messages.
Single sign-on or identity provider logs: Check if the user belongs to your managed directory.
Project management or CRM notes: Agencies and freelancers may have temporary access records.

Hosting or security logs: Review timestamps for creation, login, and privilege changes.

If a user cannot be matched to a legitimate record, treat the account as suspicious until proven otherwise.

In many cases, the presence of an unexplained administrator account is enough to indicate the attacker maintained persistence after the initial compromise.

Review the WordPress database for hidden users

The dashboard may not show every useful detail.

To fully check WordPress users after hack incidents, inspect the database tables where user data and roles are stored.

This is especially important if the attacker tried to hide an account or alter permissions directly.

WordPress stores user records in the wp_users table and role metadata in wp_usermeta.

A suspicious account may be obvious in one table but not the other, especially if role values were modified manually.

Look for unexpected usernames or email addresses in wp_users.
Check wp_usermeta for administrator capabilities assigned to unfamiliar user IDs.
Search for accounts with recently updated timestamps if your setup tracks them through plugins or custom fields.

Inspect custom database prefixes, because some attackers assume admins will only check the default wp_ prefix.

If you are not comfortable reading the database directly, use a trusted security plugin or ask your hosting provider for help.

The key is to confirm that user data matches what appears in the dashboard, because hidden or partially modified records are common after a breach.

Check for unauthorized role changes

Sometimes attackers do not create a new user at all.

Instead, they elevate an existing subscriber or editor to administrator, which can be harder to notice if no one is watching role changes closely.

Review these possibilities:

A low-privilege account suddenly has admin rights.
An editor can install plugins or themes.
A contributor can publish content without approval.
An account with legitimate access was modified to include extra capabilities through custom code or plugins.

Examine installed plugins such as membership tools, user role editors, and custom access-control extensions.

These can be used legitimately, but they can also be abused to hide elevated access if an attacker gains administrative control.

Inspect logins and user activity

User data alone does not tell the full story.

To understand whether an account is legitimate, review login activity, IP addresses, and session behavior.

This helps distinguish a real administrator from a malicious account that simply looks plausible.

Security plugins such as Wordfence, Sucuri, iThemes Security, or Jetpack Security may provide login logs and alerts.

Your web server logs can also show when a user authenticated, changed passwords, or accessed sensitive admin pages.

Repeated logins from unfamiliar countries or cloud hosting providers.
Login attempts at unusual times compared with your normal admin team.
Multiple failed logins followed by a successful administrator login.
New accounts created and used immediately for plugin installation or file edits.

When possible, correlate login IPs with trusted staff locations or VPN ranges.

A mismatch does not always prove malicious activity, but it adds weight to your assessment.

Check for backdoor user creation methods

Attackers often leave mechanisms that recreate access even after an account is deleted.

If you only remove the visible user, the attacker may return through another path.

Look for these persistence techniques:

Malicious code in functions.php or a custom plugin that creates admin users.
Injected PHP in uploads directories or mu-plugins.
Modified core files that silently reinstate an account.
Abuse of XML-RPC, REST API endpoints, or exposed admin-ajax actions.
Scheduled tasks or database triggers that recreate roles or credentials.

This is why user review should be paired with a broader malware scan and file integrity check.

A suspicious account can be a symptom of deeper compromise rather than the only problem.

What to do when you find a suspicious user

Once you identify an account that should not exist, act carefully.

Deleting it without understanding what it touched can make forensics harder, but leaving it active gives the attacker more time.

Change passwords for all administrator, editor, hosting, and database accounts.
Revoke sessions and force logout for all users.
Remove or disable the suspicious WordPress user after documenting the username, email, role, and IP history.

Audit plugins, themes, and files for recent changes tied to that account.
Regenerate security keys in wp-config.php to invalidate old authentication cookies.
Scan for malware and compare core files against a clean WordPress installation.

If the account belonged to a real user whose credentials may be stolen, reset access across email, hosting, and any connected services.

Attackers often pivot from WordPress into other systems through reused passwords.

Prevent future unauthorized users

After you secure the site, reduce the chance of another account-based compromise by tightening access controls and monitoring user changes.

Use strong, unique passwords and a password manager.
Enable two-factor authentication for all privileged users.
Limit administrator access to only those who truly need it.
Review user roles regularly, especially on multi-author sites.
Install a security plugin with login alerts and file change monitoring.
Keep WordPress core, plugins, and themes updated promptly.
Remove unused accounts instead of leaving dormant access in place.

For agencies, publishers, and eCommerce sites, it also helps to maintain a written access policy.

Clear approval workflows make it easier to spot unauthorized accounts quickly and prove whether a user was ever supposed to exist.