What a fake WordPress admin user is and why it matters
A fake WordPress admin user is an unauthorized account created by an attacker to keep access to your site after a breach.
This guide explains how to remove fake WordPress admin user accounts safely and harden WordPress so the intrusion does not come back.
These accounts often look legitimate at first glance, but they can be tied to malicious plugins, vulnerable themes, weak passwords, or stolen credentials.
If you do not remove them completely, the attacker may regain access even after you change a password.
Signs you may have a fake admin account
Not every suspicious account is malicious, but several patterns should raise immediate concern.
Check your WordPress Users screen and compare each admin account against your known staff, developers, and agencies.
- An administrator account you do not recognize
- Recent account creation at an odd time
- Unusual usernames such as random strings or names mimicking support staff
- Admin email addresses you did not approve
- Unexpected changes to plugins, themes, or site settings
- Unknown logins in your security plugin or server logs
In many cases, a fake administrator is only one part of a broader compromise.
Attackers may also create editor accounts, add rogue cron jobs, or inject code into theme files.
First steps before you delete anything
Before removing accounts, preserve evidence and reduce the chance of losing access to your own site.
Take a full backup of both the database and the files, even if the site is already compromised.
- Create a complete backup using your host, a security plugin, or phpMyAdmin and SFTP
- Record suspicious usernames, email addresses, IP addresses, and login times
- Confirm which admin accounts belong to legitimate users
- Change passwords for all real admin users immediately
- Enable maintenance mode if the site is actively being abused
If possible, create a local copy of the database for review.
Security tools such as Wordfence, Sucuri, and MalCare can help surface indicators, but manual verification is still important.
How to remove fake WordPress admin user accounts safely
The safest approach is to remove the malicious account from the WordPress dashboard only after you have confirmed that it is not linked to a legitimate administrator.
Go to Users and open the suspicious profile.
Delete the account from WordPress
Choose Delete and review the reassignment prompt carefully.
If the account has published posts, pages, or media attachments, reassign them to a trusted user so content is not lost.
- Select the fake account
- Click Delete
- Reassign content to a real admin or editor
- Confirm the deletion
In some infections, the attacker may recreate the account if the underlying access vector remains open.
That is why deletion alone is not enough.
Remove the same user from the database if needed
If the fake account still appears after deletion, inspect the WordPress database in wp_users and wp_usermeta.
This is especially important when malware or a compromised plugin is restoring the account automatically.
Use phpMyAdmin or a database client and verify the exact user ID before deleting anything.
If you are not comfortable with SQL, ask your host or a WordPress security specialist to help, because deleting the wrong record can break legitimate accounts.
Check for hidden administrator privileges
Attackers sometimes create users with hidden admin rights by modifying role data.
Review user meta entries for unexpected capabilities such as administrator, edit_themes, install_plugins, or unfiltered_html.
Also inspect multisite networks carefully.
A compromised super admin can control every site in the network, so WordPress Multisite requires extra caution.
Find the backdoor that created the fake admin
If you want to stop the issue from returning, you must identify how the attacker got in.
Common entry points include vulnerable plugins, outdated themes, leaked credentials, and insecure hosting environments.
- Outdated WordPress core files
- Abandoned plugins or nulled themes
- Weak administrator passwords
- Compromised SFTP, SSH, or hosting panel credentials
- Malicious code in
functions.php,wp-config.php, or mu-plugins - Unauthorized REST API or XML-RPC abuse
Scan your site files for recently modified PHP files, unfamiliar code blocks, obfuscated functions, or base64-encoded payloads.
Also review wp-content/uploads, where attackers sometimes place disguised PHP files if server rules are weak.
Harden your WordPress site after removal
Once you know how to remove fake WordPress admin user accounts, the next step is closing the holes they used.
Immediate hardening dramatically lowers the risk of reinfection.
- Reset passwords for every WordPress user, database account, hosting account, and email account tied to the site
- Force logout of all sessions and rotate authentication salts in
wp-config.php - Update WordPress core, plugins, and themes to their latest stable versions
- Delete unused plugins and themes rather than just deactivating them
- Install or reconfigure a security plugin with login alerts and malware scanning
- Limit login attempts and enable two-factor authentication
If your host supports it, review file permissions so PHP cannot execute where it should not, especially in upload directories.
File integrity checks can also help detect altered core files.
Review logs to understand the compromise
Server logs and plugin logs can reveal the timeline of the attack.
Look for the first suspicious login, a plugin installation from an unfamiliar IP address, or a sudden POST request to a vulnerable endpoint.
Useful places to inspect include access logs, error logs, WordPress activity logs, and security plugin audit trails.
When available, compare timestamps with account creation dates in the database.
- Unusual login geography
- Requests to
wp-login.phporxmlrpc.php - Unexpected plugin uploads or theme editor changes
- Repeated failed logins before a successful compromise
Prevent fake admin users from returning
Long-term prevention depends on layered security and routine monitoring.
A WordPress site is far safer when access is tightly controlled and audited regularly.
- Use unique, long passwords for every admin account
- Assign the lowest role necessary, not administrator by default
- Review all users monthly and remove inactive accounts
- Keep backups offsite and test restores periodically
- Restrict administrator access by IP where practical
- Use a web application firewall from a provider such as Cloudflare or Sucuri
It also helps to set up email alerts for new user creation, plugin changes, and file edits.
Early alerts can stop a small compromise before it becomes a full site takeover.
When to bring in a WordPress security professional
If the fake admin returns after deletion, if core files keep changing, or if you discover malware in multiple locations, the compromise is likely deeper than a single rogue user.
At that point, a professional malware cleanup service or experienced WordPress developer can save time and prevent data loss.
Seek help immediately if the site handles payments, member logins, client data, or any regulated information.
In those cases, containment, evidence preservation, and careful recovery matter as much as deletion.