How to Remove an Unknown FTP Account After a WordPress Hack
If you found an unexpected FTP login on your hosting account after a WordPress compromise, treat it as a sign of deeper server access.
This guide shows how to remove the account, verify the damage, and lock down the site before the attacker returns.
What an Unknown FTP Account Means
An FTP account is a file-transfer credential that can let someone upload, edit, or replace WordPress files directly on your server.
When a hacker creates an account you do not recognize, they may be trying to maintain persistence, bypass WordPress admin protections, or re-upload backdoors after cleanup.
Unknown FTP access can appear in cPanel, Plesk, DirectAdmin, or your hosting provider’s custom dashboard.
In many cases, the account name looks random, references a temporary email, or points to a directory outside your normal WordPress path.
First Steps Before Deleting the Account
Do not remove the account blindly without checking for active malicious changes.
The attacker may still have files, scheduled tasks, or alternate credentials elsewhere on the server.
- Take a full backup of files and database for forensic review.
- Record the FTP username, home directory, creation time, and IP logs if available.
- Change passwords for hosting, control panel, SSH, SFTP, email, and WordPress admin accounts.
- Enable maintenance mode or temporarily take the site offline if sensitive data may be exposed.
Before cleanup, confirm whether the account is tied to a legitimate developer, agency, or migration tool.
Hosting support can often verify account creation history and session records.
How to Remove Unknown FTP Account After WordPress Hack
The exact process depends on your hosting panel, but the goal is always the same: revoke access, remove the account, and eliminate any remaining credentials or files tied to it.
In cPanel
- Log in to cPanel and open FTP Accounts.
- Review each account name, directory, and quota carefully.
- Select the unknown account and choose Delete.
- When prompted, decide whether to remove files in that account’s directory only after confirming they are not needed.
- Check File Manager for suspicious PHP, ZIP, or hidden files in the account’s home path.
In Plesk
- Open the domain’s FTP Access settings.
- Find the unknown login and remove it.
- Inspect the domain’s file tree for recent uploads, especially in
wp-content,uploads, and root directories. - Review any additional users under subscription or reseller-level access.
Through Hosting Support
If you do not have direct access to FTP user management, ask support to disable the account immediately.
Request confirmation of the deletion, the IP addresses used by the account, and whether any SSH keys, SFTP users, or control panel subusers were also created.
Check for Persistence After Deleting the FTP User
Deleting one credential does not fully clean a hacked WordPress environment.
Attackers often leave multiple access paths so they can return later.
- Review wp-config.php for added database users, strange include statements, or obfuscated code.
- Scan .htaccess for redirects, rewrite rules, or base64-encoded payloads.
- Inspect wp-content/uploads for PHP files, executable scripts, or renamed shells.
- Check cron jobs in the server panel and WordPress scheduled tasks for malicious automation.
- Search for new admin users in WordPress, especially accounts with unfamiliar email addresses or roles.
Also look for changes in security plugins, API keys, and theme files.
A common tactic is to hide malware inside legitimate-looking functions in functions.php or a custom plugin.
Find the Entry Point That Allowed the Account to Exist
To prevent reinfection, determine how the attacker gained access in the first place.
An unknown FTP account usually indicates one of several weak points:
- Compromised hosting password reused from another service
- Phishing of a site administrator or developer
- Exposed backup files containing credentials
- Vulnerable plugin or theme that led to privilege escalation
- Insecure file permissions or writable directories
- Stolen SFTP keys stored on a local machine
Review your hosting logs, WordPress authentication logs, and server access history.
If possible, compare creation timestamps for the FTP account, new files, and suspicious login events to identify the timeline of compromise.
Clean the WordPress Site After FTP Account Removal
Once the account is deleted, perform a full malware cleanup.
A partial cleanup often leaves the site vulnerable to reinfection within hours or days.
- Replace WordPress core files with fresh copies from the official release.
- Reinstall trusted themes and plugins from verified sources.
- Remove unused themes, plugins, and old backups from public directories.
- Run a malware scan with a reputable security tool or server-side scanner.
- Reset all salts and security keys in
wp-config.php.
If you manage customer data, ecommerce orders, or membership information, document the cleanup process carefully.
Depending on the breach, you may also need to notify users or comply with applicable privacy and security obligations.
Harden the Server to Stop New FTP Accounts
After remediation, reduce the chance that another unknown account can be created.
The best defense is limiting how and where file access is granted.
- Use SFTP or SSH instead of plain FTP, since FTP transmits credentials unencrypted.
- Disable anonymous FTP and remove accounts you no longer need.
- Use strong, unique passwords stored in a password manager.
- Enable two-factor authentication for your hosting control panel.
- Restrict FTP users to a single directory with the least privilege necessary.
- Update WordPress, plugins, themes, PHP, and the hosting stack regularly.
If your host supports it, enforce IP allowlisting for admin panels and file access.
For agencies and teams, create individual accounts instead of sharing one set of credentials across multiple people.
When to Restore From Backup Instead of Cleaning In Place
In some cases, restoring a known-good backup is safer than manually cleaning a heavily compromised site.
This is especially true if the attacker modified many files, planted multiple backdoors, or tampered with database content.
Choose a restore strategy only when the backup predates the intrusion and does not contain malware.
After restoration, still change every password, remove unknown FTP accounts again, and recheck logs to confirm the attack path is closed.
Signs the Account Is Still Active Somewhere Else
Even after deletion, watch for evidence that the attacker retained access through another route.
Common warning signs include sudden file changes, new spam redirects, strange outbound traffic, or another unknown account appearing days later.
- Reappearing PHP files in uploads folders
- New admin users in WordPress
- Unexpected edits to SEO metadata or homepage content
- Outbound mail spikes from the server
- Login attempts from unfamiliar geographic locations
If any of these appear, assume the compromise is not fully contained.
Re-examine server permissions, mailbox security, connected developer tools, and any integrations with external deployment systems.
What to Document for Future Security Reviews
Keep a clean incident record so you can improve defenses later.
Useful details include the unknown FTP username, the account path, timestamps, affected files, malware signatures, log excerpts, and every remediation step taken.
This documentation helps with hosting support, insurance claims, legal review, and internal security audits.
It also makes the next incident faster to resolve because you already know which accounts, directories, and logs matter most.