Short answer: an administrator account you cannot account for almost always means someone gained privileged access. Deleting it immediately feels productive, but it removes evidence and does nothing about how they got in — a backdoor will recreate it.
Capture before you change
- Record the username, email, registration date and role. In
wp_usersandwp_usermetathe registration date and capabilities are timestamped. - Check whether other accounts had their role or email quietly changed.
- Review server access logs around the registration timestamp to find the request that created it.
- Back up the current state as evidence.
How these accounts appear
- A vulnerable plugin allowing privilege escalation or arbitrary user creation.
- Stolen administrator, hosting or FTP credentials.
- A backdoor file that recreates the account whenever it is deleted — find it with
grep -RIlE "wp_insert_user|wp_create_user|add_role" wp-content/alongside the obfuscation search. - A malicious plugin or theme installed from an untrusted “nulled” source.
Recover control properly
Removing the account is one step. Rotate every legitimate administrator’s password, invalidate active sessions, review the cron array and files for persistence, and update or replace the component that allowed access. If the account reappears after deletion, that is confirmation a backdoor is still present — do not just keep deleting it.
Verify and monitor
Re-check the user list, confirm no unexpected role changes remain, and watch new registrations over the following weeks. Also review whether the attacker used the access to publish content, add redirects or alter your search visibility while they held it.
WP REPAIR INCIDENT STANDARD
Reconstruct the incident before fixing it
An unexplained administrator is evidence of privileged access. Deleting it is containment, not investigation, and can erase the timestamp and attributes needed to trace creation.
- 1
Record username, email, registration date, capabilities and user metadata.
- 2
Review access and application logs around creation and role changes.
- 3
Search for code or cron that creates users or restores capabilities.
- 4
Check whether legitimate accounts, site email or API keys were also changed.
What must be verified
- Only justified privileged users remain.
- Sessions and credentials are rotated intentionally.
- No code, task or vulnerable component can recreate the account.
Official technical sources
This guide explains the diagnosis. If the site is affected now, the intervention should preserve a rollback path and verify the real business journey.
See the emergency repair service →ABOUT THIS SYMPTOM
Frequently asked questions about this guide.
Is it ever safe to just delete an unknown administrator account right away?+
No. Deleting it first destroys the evidence you need to find how the attacker got in, and if a backdoor is still present the account will simply be recreated. Record the username, email, registration date and role before changing anything, then remove it as one step inside a full cleanup.
If I delete the account and it comes back, what does that mean?+
It confirms a backdoor is still active on the site. A file is recreating the administrator automatically, so you need to search for it directly, for example with a grep for functions like wp_insert_user or wp_create_user in wp-content, rather than deleting the account again.
Could a rogue admin account be caused by something other than a hack?+
It's very unlikely on its own. The usual causes are a vulnerable plugin allowing privilege escalation, stolen credentials, a backdoor file, or a malicious plugin or theme installed from a nulled source. Treat any administrator you cannot account for as a compromise until proven otherwise.
Besides removing the account, what else has to happen before the site is actually safe?+
Rotate every legitimate administrator's password, invalidate active sessions, check the cron array and files for persistence, and update or replace whatever let the attacker in. You should also check whether they published content, added redirects, or altered your search visibility while they had access.