If you found an unfamiliar administrator account in WordPress, act quickly: it may indicate a compromise, a rogue contractor, or a leftover test user.
This guide explains how to remove an unknown WordPress admin account safely while protecting access, data, and search visibility.
Why an Unknown Admin Account Is a Serious Risk
An administrator account has the highest level of access in WordPress.
It can install plugins, edit theme files, create users, change site settings, and publish content, which means a malicious admin can hide malware, redirect traffic, or lock you out entirely.
Common causes of an unexpected admin account include:
- Credential theft through phishing or malware
- Weak passwords reused across sites
- Abandoned staging or test accounts
- Plugin vulnerabilities that allowed privilege escalation
- A former developer, agency, or freelancer leaving access behind
Before deleting anything, confirm whether the account belongs to a legitimate team member.
If it does not, move directly to containment and recovery steps.
What to Do Before You Delete the Account
Removing the account too early can cause content loss or make it harder to investigate what happened.
Start with a quick safety checklist.
Take a full backup
Create a complete backup of the WordPress database and files.
Use a trusted backup plugin, your hosting provider’s backup tool, or a manual export.
Keep a copy offline if possible.
Record account details
Document the unknown user’s username, email address, display name, role, creation date, and any recent activity.
If your security plugin or activity log shows logins, IP addresses, or file edits, save those logs too.
Change your own credentials first
If the site may be compromised, update passwords for your WordPress admin account, hosting panel, database user, FTP or SFTP, and connected email accounts.
Enable multi-factor authentication wherever available.
Scan for additional compromise
Look for suspicious plugins, modified theme files, unknown admin users, and unfamiliar scheduled tasks.
A rogue administrator is often only one part of a broader intrusion.
How to Remove Unknown WordPress Admin Account from the Dashboard
If you still have legitimate admin access, the simplest way to remove the account is through the WordPress dashboard.
- Log in to WordPress as a trusted administrator.
- Go to Users and open All Users.
- Locate the suspicious account and confirm the role is Administrator.
- Hover over the user and select Delete.
- When prompted, decide what to do with the account’s content.
WordPress typically offers two options: delete the user’s content or attribute it to another account.
If the user published legitimate posts, assign them to a trusted editor or administrator so content remains intact.
If you are uncertain whether the account is malicious, you can first downgrade the role to Subscriber and monitor for unexpected behavior.
However, if you are actively responding to a breach, delete the account after preserving evidence.
How to Remove the Account with phpMyAdmin When You Are Locked Out
If you cannot access the dashboard, you may need to remove the account directly from the database.
This method is powerful and should be used carefully, ideally after creating a backup.
Find the WordPress database tables
Open phpMyAdmin through your hosting control panel and select the WordPress database.
Most sites use the default tables wp_users and wp_usermeta, though your prefix may be different.
Identify the unknown user
Run a query to list users and review usernames, emails, and IDs:
SELECT ID, user_login, user_email, user_registered FROM wp_users;Once you confirm the suspicious user ID, inspect the role data in user meta to verify administrator privileges.
Delete the user and related meta
After verifying the account, remove the user row and associated metadata.
In most cases, you should delete the record from wp_users and all matching rows in wp_usermeta for that user ID.
If you are not experienced with SQL, ask your host or a WordPress security specialist for help.
An incorrect query can break logins or damage user data.
Alternative Ways to Remove the Admin Account
Some recovery scenarios require a different approach depending on what access you still have.
Use WP-CLI
If SSH access is available, WP-CLI provides a fast and reliable method.
You can list users and delete the account from the command line, which is useful for developers and managed hosting environments.
Reset the site from a clean backup
If the site was heavily compromised, restoring a known-good backup may be safer than manual cleanup.
Choose a backup created before the unknown admin appeared, then rotate passwords immediately after restoration.
Ask your host to intervene
Many managed WordPress hosts can suspend suspicious access, review logs, or help remove unauthorized users.
Some also offer malware cleanup and post-intrusion remediation.
How to Verify the Account Is Truly Gone
After deletion, confirm the account no longer exists and the compromise has been contained.
- Reopen Users > All Users and verify the account is absent.
- Check the database for any remaining rows tied to that user ID.
- Review activity logs for repeated login attempts or new user creation.
- Clear caches from WordPress, your CDN, and your browser.
- Test logins, contact forms, and key front-end pages.
Also confirm no new administrator accounts were created while you were investigating.
Attackers often create multiple backdoor users to regain access later.
Security Steps to Take After Removal
Deleting the unknown admin account is only one part of the response.
Harden the site so the same problem does not recur.
- Change all passwords again, including hosting, database, FTP, and email
- Enable two-factor authentication for every administrator
- Remove unused plugins and themes
- Update WordPress core, plugins, and themes
- Limit admin access to the smallest number of trusted users
- Install a security plugin with login alerts and file integrity monitoring
- Review user roles and remove legacy accounts
If you use an agency or development team, confirm who should have administrator access and document a formal offboarding process.
Many WordPress security incidents begin with forgotten credentials or stale permissions.
How to Prevent Another Unknown Admin Account
Prevention depends on identity controls, monitoring, and good maintenance habits.
Strong passwords alone are not enough.
Use least privilege
Give users the lowest role they need.
Authors and editors usually do not need administrator access, and temporary collaborators should lose access when work ends.
Monitor user changes
Set up notifications for new users, role changes, plugin installs, and login events.
Activity logging tools can reveal the exact moment a suspicious admin was created.
Secure the login surface
Protect wp-admin with multi-factor authentication, rate limiting, and, where practical, a Web Application Firewall.
Consider restricting admin access by IP for high-risk environments.
Keep the environment updated
Outdated plugins and themes are among the most common entry points for attackers.
Maintain a regular update schedule and remove anything no longer in use.
If you are trying to learn how to remove unknown WordPress admin account entries after a suspected intrusion, the key is to back up first, verify the user, remove the access, and then harden the site immediately.
In practice, the fastest cleanup is the one paired with the strongest follow-up security.