WordPress Hacked? Remove Fake Admin Users and Secure It

Finding an unknown administrator inside your WordPress dashboard is a serious security warning. If someone has added a fake or unauthorized admin user, simply deleting that account may not solve the WordPress hacking problem. The attacker may have already changed passwords, installed a malicious plugin, modified theme files, added hidden users, inserted malware, or created another way to regain access. The safest approach is to treat the incident as a potential website compromise, preserve useful evidence, remove unauthorized access, scan the complete installation, clean or replace compromised files, and then secure every connected account.

This guide explains what to do when fake admin users are added to WordPress, why it happens, how to regain control, how to find hidden persistence, and how to reduce the chances of the problem returning.

WordPress Hacked: How to Remove Fake Admin Users and Secure Your Site

Main Topics

🚨 Warning Signs 🛡️ Immediate Actions 👤 Remove Fake Admins 🔍 Find Malware 🧹 Clean the Website 🔐 Secure WordPress ✅ Prevent Future Hacks ❓ FAQ

Quick answer: If an unknown WordPress administrator has appeared, first protect your access and preserve a backup or forensic copy if possible. Then remove unauthorized users, change credentials, scan WordPress files and the database, inspect plugins and themes, update or replace compromised components, invalidate active sessions, and check your hosting environment. Do not assume the site is clean just because the suspicious user disappears.

🚨 Why Is a Fake WordPress Admin User a Serious Warning?

A WordPress Administrator has powerful permissions. On a normal single-site installation, an administrator can manage users, plugins, themes, settings and other important parts of the website.

That means an unfamiliar administrator account is not the same as an ordinary unwanted subscriber. If an attacker controls an administrator account, they may be able to change the website or create additional access.

Possible warning signs include:

• An unfamiliar administrator appears under Users → All Users.
• A new account has an unknown email address.
• Your administrator role suddenly changes.
• Plugins or themes appear that you did not install.
• Unexpected files appear inside wp-content.
• Website content, menus or settings change without permission.
• Visitors are redirected to strange websites.
• Spam pages or links appear in search results.
• Your hosting account shows unusual activity.
• You receive unexpected password-reset or user-registration notifications.

Important: An unknown administrator does not automatically prove exactly how the site was compromised. It could be a stolen password, vulnerable plugin, compromised hosting account, leaked credential, malicious code, or another security weakness. Investigate instead of guessing.

🛡️ Step 1: Do Not Start Deleting Everything Immediately

Your first instinct may be to delete the suspicious account and remove random files. That can sometimes make the situation worse.

If the website has been compromised, you may want to preserve information that can help identify the entry point. Before making major changes, create a complete backup or snapshot of the website files and database if your hosting environment allows it.

Keep the backup somewhere separate from the compromised hosting account. A backup stored only on the same server may also be affected.

Also note:

• Username and email address of suspicious users.
• Approximate account creation time.
• Recently modified files.
• Unexpected plugins and themes.
• Recent hosting or security alerts.
• Suspicious redirects or website changes.

This information can be useful if you later need help from your hosting company or a WordPress security professional.

🔑 Step 2: Secure the Accounts That Control WordPress

If an attacker obtained your WordPress password, changing only the WordPress password may not be enough.

Change credentials for accounts that could provide access to your website, including:

• WordPress administrator accounts
• Hosting control panel
• Primary email account
• FTP/SFTP accounts
• SSH accounts
• Database credentials, when appropriate
• Domain registrar account
• Third-party services connected to WordPress

Use unique, long passwords rather than reusing the same password across different services. Enable two-factor authentication (2FA) wherever available.

If you believe your email account itself may be compromised, secure the email account first. Otherwise, an attacker may simply use password recovery to regain access.

👤 Step 3: Remove the Fake or Unauthorized WordPress Admin

If you still have legitimate administrator access, open Users → All Users and carefully review the accounts.

Do not delete a user simply because the username looks unusual. First confirm that the account is not used by a legitimate team member, developer, agency or automation service.

For a clearly unauthorized administrator:

1. Record the username, email and account details.
2. Check whether the account owns important posts or pages.
3. Remove the unauthorized account.
4. If WordPress asks what to do with the user's content, reassign it to a trusted account when appropriate.
5. Review the remaining administrator accounts.

WordPress uses roles and capabilities to control what users can do. Administrators have extensive permissions, so keeping the number of administrator accounts as small as practical is a useful security measure.

Do not stop here. If an attacker created one administrator account, deleting that account does not prove that the underlying vulnerability or malicious code has disappeared.

🔐 What If You Cannot Log In to WordPress?

If your legitimate administrator account has been removed or your password no longer works, avoid randomly editing database records unless you understand the risks.

Depending on your hosting environment, safer recovery options can include:

• Using WordPress's legitimate password-recovery process.
• Asking your hosting provider for account recovery assistance.
• Using WP-CLI if you have trusted SSH access.
• Restoring a known-clean backup.
• Working with a WordPress security professional.

WP-CLI provides commands for listing, updating, deleting and resetting WordPress users.

Technical correction: Older tutorials often recommend manually changing the user_pass field through phpMyAdmin using MD5. WordPress documentation still describes this as a recovery technique, but direct database editing is risky for inexperienced users. If you have another recovery method available, use it first.

🔍 Step 4: Scan the Entire WordPress Installation

After removing unauthorized accounts, investigate the website for malware and other signs of compromise.

A proper WordPress security scan should not focus only on the homepage. Depending on the security tool, inspect:

• WordPress core files
• Plugins
• The active theme
• Inactive plugins and themes
• wp-content/uploads
• Configuration files
• Database content
• Scheduled tasks and suspicious cron activity
• Unexpected PHP files
• Server logs, where available

A reputable security solution can help identify suspicious files, known malware signatures and some vulnerable components. Your hosting provider may also offer server-side malware scanning.

Use more than one source of evidence when possible. A single scanner can miss a customized backdoor or a recently modified malicious script.

🧩 Step 5: Check Plugins and Themes Carefully

Plugins and themes are common parts of a WordPress website, but every additional component increases the amount of code that must be maintained and trusted.

Review the installation and ask:

• Do I recognize every installed plugin?
• Is the plugin still required?
• Did I download it from a trustworthy source?
• Is the theme genuine?
• Are there unused plugins or themes?
• Are any components outdated?
• Has any plugin or theme been modified unexpectedly?

Never use pirated, nulled or illegally redistributed premium plugins and themes. Apart from licensing problems, modified packages can contain malicious code or unwanted backdoors.

Remove software that you do not need rather than simply leaving it inactive forever.

🧹 Step 6: Clean or Replace Compromised Files

If a scanner identifies infected files, do not automatically delete every file it reports. Some files may be legitimate but contain code that the scanner considers suspicious.

For official WordPress core files, a clean copy from the official WordPress distribution can be used to replace modified core files. For plugins and themes, obtain fresh copies from their legitimate sources.

A safer cleaning strategy is usually:

1. Keep a backup of the compromised state for investigation.
2. Identify affected files.
3. Replace compromised core/plugin/theme files with clean copies.
4. Remove software that is unnecessary or untrusted.
5. Inspect custom code separately.
6. Rescan after cleaning.

Be extremely careful when manually editing PHP files. Malicious code is not always obvious, and deleting one suspicious-looking line can break the website without removing the real backdoor.

If you do not understand PHP, WordPress file structure or server permissions, manual malware removal can create additional problems. In a serious compromise, professional malware cleanup may be safer than guessing which code should be deleted.

🗄️ Step 7: Do Not Forget the WordPress Database

Cleaning files is only half of the investigation. Attackers may also modify the database.

Look for unexpected:

• Administrator or privileged users
• User metadata
• Posts and pages
• Injected links
• Malicious JavaScript
• Suspicious options
• Unknown scheduled tasks
• Unexpected site settings

If spam or malicious content was inserted into posts, widgets or settings, removing the infected PHP file alone will not necessarily remove it.

🔄 Step 8: Update WordPress, Plugins and Themes

Once you have a clean recovery point, update WordPress core, themes and plugins to supported versions.

Updates are important because security fixes are frequently delivered through software updates. However, updating alone is not a malware-cleaning method. If the site is already compromised, an update may leave a separate backdoor or malicious database entry untouched.

Therefore, think of the process as:

Investigate → Clean → Update → Rescan → Secure.

🔒 Step 9: Invalidate Existing Access

When you suspect account compromise, changing the password is only part of the job.

Review active sessions and application access where applicable. Revoke credentials or application passwords that you do not recognize. Rotate API keys and other secrets that may have been exposed.

Also consider regenerating WordPress authentication salts in wp-config.php after a confirmed compromise. This can help invalidate existing authentication cookies.

Do this carefully and preferably after understanding the impact on legitimate users and connected services.

🌐 Step 10: Check the Hosting Environment

A WordPress website does not live in isolation. If suspicious activity continues after cleaning WordPress, the problem may exist at the hosting or account level.

Ask your hosting provider to check for:

• Unexpected FTP/SFTP accounts
• Unknown SSH keys
• Suspicious cron jobs
• Recently created files outside the WordPress directory
• Other compromised websites under the same hosting account
• Unusual login activity
• Server-level malware

If several websites share one hosting account, investigate all of them. Cleaning only one installation may not solve the problem if another infected site can reinfect it.

📊 Common Causes of Fake WordPress Admin Accounts

Possible Cause	What It Means	What to Check
Stolen password	An attacker obtained legitimate login credentials.	Password history, login activity, email security and 2FA.
Vulnerable plugin	A plugin weakness may have allowed unauthorized access.	Plugin versions, security advisories and logs.
Malicious plugin/theme	Untrusted software may contain a backdoor.	Recently installed and modified components.
Compromised hosting	The server or hosting account may be affected.	Hosting logs, FTP/SSH users and other sites.
Leaked credentials	Passwords or keys may have been exposed elsewhere.	Email, hosting, API and third-party accounts.

🔐 How to Secure WordPress After a Hack

Once the website is clean, turn your attention to prevention.

• Use strong, unique passwords for every important account.
• Enable two-factor authentication for administrator accounts where possible.
• Keep WordPress updated.
• Keep plugins and themes updated.
• Remove unused plugins and themes.
• Use a reputable security plugin or monitoring service.
• Use a web application firewall (WAF) when appropriate.
• Keep tested off-site backups.
• Use secure hosting.
• Give users only the permissions they actually need.
• Avoid pirated or nulled WordPress software.
• Review administrator accounts regularly.

WordPress itself recommends a layered approach to security, including backups and appropriate server/database controls rather than relying on a single protection method.

🧠 A Simple WordPress Security Routine

You do not need to become a cybersecurity expert to establish a useful routine.

Weekly: check updates, administrator accounts and security notifications.

Regularly: test backups, remove unused software and review hosting accounts.

After every major change: create a fresh backup and verify that the website works correctly.

After suspicious activity: investigate before assuming the problem has disappeared.

The goal is not to make a WordPress website impossible to attack. The goal is to reduce attack opportunities, detect abnormal behavior quickly, limit damage and recover reliably.

🚩 When Should You Ask a Security Professional for Help?

Professional assistance is strongly worth considering when:

• The attacker keeps recreating admin accounts.
• You cannot identify the malicious code.
• The website redirects visitors.
• Search engines display malware or spam warnings.
• Multiple websites on the hosting account are infected.
• You suspect the hosting account itself is compromised.
• Important customer or business information may have been exposed.
• The site becomes reinfected after cleaning.

A professional can also compare clean and compromised versions, inspect logs, analyze persistence mechanisms and help rebuild the site from a trusted state.

❓ Frequently Asked Questions

Is a fake WordPress admin user proof that my website has been hacked?

An unknown administrator is a strong security warning, especially if you did not create the account. However, investigate the account and related activity before deciding exactly how the access occurred.

Can I simply delete the fake administrator?

You should remove a confirmed unauthorized account, but deleting it is not enough. The attacker may have another account, malicious file, compromised password, API key or database modification.

Why do fake admin users keep coming back after I delete them?

This usually indicates that the underlying access path has not been removed. Possible causes include malware, a vulnerable plugin, compromised hosting credentials, stolen passwords or another persistent backdoor.

Should I manually delete suspicious PHP code?

Only if you understand exactly what the code does and have a reliable backup. Malicious code can be difficult to identify, and deleting legitimate code can break the website.

Should I reset my WordPress password after a hack?

Yes. Also consider changing other credentials that may have been exposed, including hosting, email, FTP/SFTP, SSH and relevant third-party services.

Is a security plugin enough to protect WordPress?

No single security tool guarantees complete protection. Security plugins can provide valuable scanning and monitoring, but secure credentials, updates, backups, trusted software, hosting security and good access control are also important.

Can a hacked WordPress site affect SEO?

Yes. Malware, spam pages, unwanted redirects and injected links can affect visitors and search visibility. If suspicious content has been indexed, investigate the compromise and clean the site before focusing on SEO recovery.

What is the safest way to recover a seriously hacked WordPress website?

For a major compromise, a known-clean backup or a controlled rebuild can be safer than trying to remove every malicious change manually. Always investigate why the compromise happened so the same weakness does not immediately return.

Conclusion

A new or fake WordPress administrator should be treated as a potential security incident, not just an unwanted user. Removing the account is an important first step, but it is only one part of the recovery process.

The better approach is to protect your legitimate accounts, preserve a backup or useful evidence, remove unauthorized access, scan files and the database, replace compromised software with trusted copies, inspect hosting access, rotate exposed credentials, update the website and rescan everything.

After recovery, maintain a simple security routine with strong passwords, 2FA, regular updates, trusted plugins and themes, tested backups, limited administrator access and continuous monitoring. WordPress administrators have extensive capabilities, so minimizing unnecessary privileged accounts is especially important.

Remember: A clean-looking dashboard does not always mean a clean website. If unauthorized administrators continue appearing, stop repeatedly deleting them and investigate the underlying compromise.

Disclaimer

This article is provided for general educational and informational purposes. WordPress security incidents can involve files, databases, hosting accounts, credentials and third-party services. Always create a reliable backup before making major changes, and seek qualified professional assistance if you are dealing with a serious compromise, sensitive data exposure or an infection that keeps returning.