An unknown administrator has appeared

An administrator you didn't create yourself is one of the clearest signs of a break-in. An extra administrator lets an attacker come back later, even after the security hole has been closed.

Do it in this order: write down what you see, lock the user out, change the passwords and delete the user. What you know about the user can show how the attacker got in, so note it before the user is deleted. Then find and close the security hole, or the attacker can come back.

Check whether someone you know created it

Start with the user's email address under Users → All Users, because it can tell you who it is. A domain that belongs to a previous developer, your host or a plugin you use suggests a support account someone created on purpose. A random Gmail or Outlook address, a temporary email address or a domain you don't recognise points to a break-in. Also search the web for the address and the domain.

Then ask the people who have worked on the site: previous developers, your host and anyone else with administrator access. If nobody recognises the account, assume someone has broken in.

Write down what you see

1. Go to Users → All Users and write down the username, name and email address, or take a screenshot.
2. Check the Posts column to see whether the user has published anything. The number links to the posts.
3. Click Administrator at the top of the list. If the number in brackets is higher than the number of users you can see, an administrator may be hidden.
4. Open every administrator's profile, including your own, and look under Application Passwords. An application password you don't recognise lets someone log in without the normal password.
5. If the site has a plugin that logs activity, it may show when the user was created and from which IP address. Write that down too.

Malicious code can hide users from the list in wp-admin. The query below reads every administrator straight from the database, with the time the account was created (user_registered, in UTC). Run it in phpMyAdmin. If the site uses a prefix other than wp_, change it in the table names and in wp_capabilities.

SELECT u.ID, u.user_login, u.user_email, u.user_registered
FROM wp_users u
JOIN wp_usermeta m ON m.user_id = u.ID
WHERE m.meta_key = 'wp_capabilities' AND m.meta_value LIKE '%administrator%';

Lock the user out

WordPress has no button to deactivate a user, but you can remove all access without deleting the account:

1. Go to Users → All Users and open the user.
2. Under Role, choose "No role for this site". The user then has no rights, even if the attacker manages to log in.
3. Click "Set New Password", and WordPress creates a strong password nobody knows.
4. Click "Update User".
5. If the user is logged in, click "Log Out Everywhere" under Sessions. If the user has application passwords, click "Revoke" next to each of them.

Ask your host to keep the logs

The access logs from the days before the user appeared can show how the attacker got in. Many hosts delete them after a while, so ask your host to keep them right away, or download them from your hosting panel.

Change the passwords

1. Change the password of every other administrator. If the site has a two-factor plugin, turn it on for everyone.
2. Change the passwords for the hosting panel, FTP and the database. The new database password has to go into DB_PASSWORD in wp-config.php at the same time, or the site loses its connection to the database.
3. Replace the salt keys in wp-config.php, so everyone who is logged in gets logged out. Get new keys from https://api.wordpress.org/secret-key/1.1/salt/, or run wp config shuffle-salts in WP-CLI.

If you aren't used to editing wp-config.php, ask your host or whoever runs the site to do steps 2 and 3.

Delete the user

Once the passwords are changed, delete the user under Users → All Users. To keep the content and review it afterwards, choose "Attribute all content to another user." and pick a user from the list.

Close the security hole

Once the user is locked out or deleted, you have to find out how the attacker got in. It can be a plugin or theme with a known security hole, or a leaked password.

1. Scan the site at wpscan.com. Paste in the address to get a free report of plugins, themes and WordPress versions with known security holes. The scanner only sees what is visible from outside. Alternatively, install Jetpack Protect or Wordfence, which can see everything you have installed and give you a more thorough review.
2. Update every plugin and theme. Delete the ones you don't use, and replace the ones that no longer get updates.
3. Update WordPress to the latest version.
4. Update PHP to a version that still gets security updates. How to change the PHP version.
5. Go to Settings → General. Check that "Anyone can register" isn't ticked and that "New User Default Role" isn't set to Administrator.
6. Scan the site for malware, for example with Wordfence. It can find backdoors the attacker left behind.

When you don't know how the attacker got in

If the scans find nothing and you don't know how the user got in, assume the security hole is still open. The attacker may also have left backdoors in the files or the database. Someone with WordPress security experience needs to go through the files, the database and the server logs, which requires full access to the hosting account.