To remove unauthorized administrator access in WordPress: verify the account is truly unauthorized, secure all legitimate admin accounts, delete the rogue user via the dashboard or database, then audit all users, roles, plugins, and hosting access.
Finding an unexpected Administrator account on your WordPress website is a serious security signal.
An unfamiliar Administrator may be a forgotten legitimate account, a former developer who still has access, a user with the wrong role, or a clear sign of WordPress unauthorized admin access by a malicious actor.
Because the Administrator role controls users, plugins, themes, settings, and code, any unauthorized WordPress administrator must be investigated promptly — but not deleted blindly.
This 2026 guide explains how to safely remove unauthorized WordPress admin accounts, secure your site, and prevent future compromises. It covers both dashboard and database methods, plus a full incident-response checklist for WordPress admin security.
Last updated: September 2026 | Tested on WordPress 7.0+
What Is Unauthorized Administrator Access in WordPress?
Unauthorized administrator access in WordPress occurs when a user has full admin privileges without legitimate approval.
Common scenarios include:
An unauthorized WordPress user account is created with the Administrator role
A legitimate user is unexpectedly promoted to Administrator
A former employee or developer retains admin access
An existing Administrator account is compromised (stolen password, session hijack)
A plugin, theme, or custom code grants admin capabilities unintentionally
Not every unexpected Administrator means your site is hacked, but any unauthorized WordPress administrator should be treated as a security incident until verified.wp-detox+1
Why Administrator Access Is So Sensitive
The WordPress Administrator role has broad control over your installation. Depending on your setup, an Administrator can manage:
Users and roles
All content (posts, pages, media)
Plugins and themes (install, activate, edit code)
Site settings and configuration
Custom code via theme/plugin editors
This means an unauthorized WordPress admin access situation can lead to:
Data theft or defacement
Malware injection
Creation of backdoor accounts
Full site takeover
For a broader overview, see the official WordPress Roles and Capabilities documentation.
Before You Remove the Account: Verify First
One of the biggest mistakes is deleting an unfamiliar account without investigation. The account might belong to:
A website owner
A legitimate developer or agency
A maintenance provider
A previous administrator
Another team member
Before taking action, verify:
Username and display name
Email address
Assigned role
Account creation date
Known website personnel
Recent activity (if logging is enabled)
If nobody recognizes the account, proceed with a full audit.
Step 1: List All WordPress Administrators
Start by reviewing all users with Administrator privileges.
Go to Users → All Users in your dashboard.
Filter or scan for the Administrator role.
Create a simple inventory:
This immediately shows whether admin access is limited to known, trusted users.
Step 2: Verify Every Administrator
For each Administrator, ask:
Who is this person?
Why do they have Administrator access?
Do they still work with this website?
Do they still need this level of access?
The first three questions establish legitimacy.
The fourth addresses excessive privileges, a common WordPress admin security issue.
A user can be legitimate but overprivileged (e.g., a writer with full admin rights). In that case, you don’t delete — you downgrade.
Step 3: Identify the Suspicious or Unauthorized Account
Pay particular attention to accounts with:
Unknown usernames or email addresses
Unexpected Administrator privileges
Recent creation dates
No identifiable owner or documented purpose
Also look for accounts created around the same time as:
Unfamiliar plugins or themes
Unexpected content changes
Strange email notifications
Document what you find before making changes.
Step 4: Check Whether the User Was Recently Promoted
An unauthorized WordPress administrator doesn’t have to be a new account. Someone may have changed an existing user’s role:
Author → Administrator
Editor → Administrator
Possible causes:
Human error
Misconfigured plugin
Custom code bug
Compromised account
An unexplained role change is a red flag for WordPress unauthorized admin access and deserves investigation.
Step 5: Secure Legitimate Administrator Accounts
If you suspect unauthorized access, don’t focus only on the suspicious account. Secure all known Administrator accounts:
Use strong, unique passwords
Ensure each admin has their own account (no shared logins)
Enable two-factor authentication (2FA) if possible
Update recovery emails and phone numbers
If you believe an existing Administrator account may be compromised, secure it before assuming that deleting another account solves the problem.
Step 6: Remove the Unauthorized Administrator (Dashboard Method)
Once you’ve confirmed an account is unauthorized and you still have legitimate admin access:
Go to Users → All Users.
Find the unauthorized WordPress user.
Hover over their name and click Delete.
When prompted, decide what to do with their content:
Attribute content to another user, or
Delete all content (only if you’re sure it’s not needed)
Choose carefully so you don’t unintentionally remove legitimate posts or pages.
This is the standard way to remove WordPress administrator accounts via the dashboard.
Step 7: Remove Hidden Admins via Database (Advanced)
Some attackers hide admin accounts so they don’t appear in the dashboard. To fully remove unauthorized WordPress admin access, check the database directly.
7.1. Find All Administrators in the Database
Using phpMyAdmin, Adminer, or your host’s database tool, run:
SELECT u.ID, u.user_login, u.user_email, u.user_registered
FROM wp_users u
JOIN wp_usermeta m ON u.ID = m.user_id
WHERE m.meta_key = 'wp_capabilities'
AND m.meta_value LIKE '%administrator%';Adjust wp_ if your table prefix is different.
Look for:
Unknown
user_loginoruser_emailRecent
user_registereddatesAccounts you didn’t create
7.2. Delete a Rogue Admin via SQL
Once you’ve identified an unauthorized WordPress administrator:
-- First, note the user ID (e.g., ID = 17)
-- Then reassign their content to a trusted admin (e.g., ID = 1)
UPDATE wp_posts SET post_author = 1 WHERE post_author = 17;-- Delete user meta
DELETE FROM wp_usermeta WHERE user_id = 17;
-- Delete user
DELETE FROM wp_users WHERE ID = 17;
Always back up your database before running these queries.
7.3. Remove Admin via WP-CLI (If Available)
If your host supports WP-CLI:
# List all administrators
wp user list --role=administrator --fields=ID,user_login,user_email# Delete a rogue admin and reassign content to user ID 1
wp user delete 17 --reassign=1
These methods help you remove unauthorized WordPress admin accounts that may be hidden from the dashboard — a key advantage over basic guides.wp-detox+1
Step 8: Downgrade Legitimate but Overprivileged Users
Sometimes the issue isn’t an unauthorized WordPress user, but excessive access.
Example:
A writer has Administrator privileges even though they only need to publish their own articles.
Instead of deleting:
Change their role to Editor, Author, or a custom role
Match their capabilities to their actual responsibilities
This follows the principle of least privilege, a core concept in WordPress admin security.
See: Principle of Least Privilege in WordPress.
Step 9: Review Every Other User on the Site
After discovering an unauthorized WordPress administrator, review the complete user list:
Other unknown users
Additional Administrators
Unexpected Editors or Authors
Duplicate accounts
Former employees or contractors
Inactive users
A broader audit can reveal multiple access problems, not just one rogue account.
See: How to Audit WordPress User Roles.
Step 10: Check for Additional Administrator Accounts
An attacker with admin privileges may create multiple backdoor accounts.
After removing one suspicious Administrator:
Refresh Users → All Users.
Re-run the database query from Step 7.1.
Confirm every remaining Administrator is:
Known
Authorized
Necessary
Properly secured
This second review helps ensure no hidden unauthorized WordPress admin access remains.
Step 11: Review Recent Website Changes
If the account appears suspicious, look for other unexpected changes:
New users
Role changes
Plugin installations or activations
Theme changes
Content modifications
Settings changes
Use security plugins (e.g., Wordfence, Sucuri) or hosting logs if available.
Your goal is to determine whether this is an isolated mistake or part of a larger compromise.
Step 12: Check Plugins and Themes
Unexpected administrative access often relates to vulnerable or malicious extensions.
Look for:
Unknown plugins or themes
Recently installed or activated plugins
Unexpected theme modifications
For each unfamiliar component, determine:
Who installed it
Why and when it appeared
Whether it’s still required
Deactivate and delete anything unnecessary or suspicious.
Step 13: Review Custom Roles and Capabilities
Don’t restrict your investigation to users labeled “Administrator”.
WordPress permissions are based on capabilities. Custom roles and plugins can grant admin-like powers to non-admin users.
Review:
Custom roles
Custom capabilities
Plugin-specific roles
See: WordPress Capabilities Explained for more detail.
Step 14: Review Former Employees and Contractors
Former team members often retain legitimate credentials long after their work ends.
Check accounts belonging to:
Former employees
Former writers or editors
Former developers
Freelancers, agencies, consultants
Ask:
Does this person still need WordPress access?
If not, remove or reduce their access immediately
Also consider their access to hosting, domain, email, and other related systems.
Step 15: Check Hosting and Other Administrative Access
WordPress may not be the only compromised system.
If you suspect WordPress unauthorized admin access, also review:
Web hosting control panel
Domain registrar account
SFTP / SSH access
Database access
CDN accounts
Backup systems
Analytics and Search Console
If another system is compromised, removing a WordPress Administrator alone won’t fully resolve the issue.
Step 16: Change Credentials When Appropriate
If credentials may have been compromised:
Use strong, unique passwords for all admin accounts
Enable multi-factor authentication (2FA) where possible
Ensure each person has their own account
Use a secure password manager
Also secure any email accounts linked to Administrator users, since password resets often go there.
Step 17: Look for Persistence Mechanisms
If you believe the site was truly compromised, consider how access could return.
Check for:
Additional unknown users
Unexpected plugins or mu-plugins
Suspicious code in theme files (e.g.,
functions.php)Unknown cron jobs or scheduled tasks
Unexpected integrations or API keys
Deleting one unauthorized WordPress administrator may not remove every backdoor. For serious incidents, consider professional incident-response help.
Step 18: Preserve Useful Evidence
If this appears to be a real security incident, avoid immediately destroying information that could help explain what happened.
Where possible, document:
User records (before deletion)
Login attempts and security plugin logs
Hosting or server logs
File modification timestamps
Recent backups
Email notifications about user or role changes
This evidence can be crucial for understanding how the unauthorized WordPress admin access occurred.
Step 19: Review Email Notifications
Unexpected WordPress or hosting emails can provide useful clues.
Look for messages about:
New user accounts
Password changes
Email or role changes
Plugin or theme installations
Security alerts
Pay attention to notifications you or your team don’t recognize. Their timing can help establish when unusual activity began.
Step 20: Check for Unauthorized Content Changes
Review your site for unexplained changes:
Posts and pages
Menus and widgets
Settings
Media library
Plugin and theme configuration
If you find suspicious changes, record them before restoring or overwriting anything.
Step 21: Review Your Backups
Reliable backups are essential for WordPress admin security.
If you discover unauthorized administrative activity, determine:
When your backups were created
Whether clean backups exist
Whether the backup includes the database and files
Whether restoration has been tested
Don’t automatically restore the newest backup; it might already contain the compromise.
Step 22: Remove Unnecessary Privileges
After the investigation:
Review permissions of all legitimate users
Ask: “Does this person still need Administrator access?”
If not, reduce their role (e.g., Administrator → Editor or Author)
This prevents the issue from becoming an ongoing overprivileging problem.
Step 23: Document What Happened
Keep a simple incident record:
Suspicious username and email
Previous role
When it was discovered
Why it was considered unauthorized
Actions taken
Other accounts reviewed
Credential changes
Relevant findings
Final status
This documentation helps if similar activity happens again.
Step 24: Perform a Complete User Role Audit
After removing the unauthorized WordPress administrator, perform a broader role review:
All Administrator accounts
Editors, Authors, Contributors, Subscribers
Custom roles and capabilities
Inactive accounts
This ensures the problem wasn’t part of a larger permission-management issue.
Step 25: Establish Better Access Controls
Once the immediate problem is resolved, improve your permission structure:
Only necessary users receive Administrator access
Users get the least privilege required for their work
Temporary access is removed after the task ends
Former users are reviewed and removed promptly
Privileged accounts use strong passwords + 2FA
Regular user-role audits are scheduled
These practices make WordPress unauthorized admin access much less likely to recur.
Unauthorized vs Excessive Administrator Access
It’s important to distinguish:
Unauthorized Access
The user should not have access at all
Example: an unknown person has an Administrator account
Response: Investigate → Secure → Remove unauthorized WordPress admin → Check for additional compromise
Excessive Access
The user is legitimate but has more access than necessary
Example: a writer has Administrator privileges
Response: Review responsibilities → Reduce role → Test access
These situations require different responses, even though both affect WordPress admin security.
When Should You Contact a Security Professional?
Consider professional help if you find:
Multiple unknown Administrator accounts
Repeated unauthorized account creation
Suspicious files or code injections
Persistent unauthorized access after cleanup
Compromised hosting or domain credentials
Significant website modifications
Possible exposure of customer or sensitive data
A professional investigation is especially useful when you can’t determine how the unauthorized WordPress administrator gained access.
Common Mistakes to Avoid
Deleting the account without investigating
You may remove a legitimate user or destroy useful evidence.Assuming one account is the only problem
Additional backdoors or accounts may exist.Ignoring existing Administrator accounts
A legitimate admin may also be compromised.Forgetting hosting and other credentials
Attackers can regain access via SFTP, hosting, or domain accounts.Ignoring plugins and themes
Vulnerable or malicious extensions often enable WordPress unauthorized admin access.Changing only one password
If several credentials are exposed, one change isn’t enough.Failing to document the incident
Without records, future investigations become much harder.Never reviewing permissions again
Access management must be ongoing, not one-time.
Unauthorized WordPress Administrator Access Checklist
Use this checklist whenever you discover an unexpected Administrator.
Identify
List all Administrator accounts
Identify every account owner
Verify each account’s purpose
Flag unfamiliar accounts
Review unexpected role changes
Secure
Secure all legitimate Administrator accounts
Review potentially compromised credentials
Enable 2FA where possible
Review associated email accounts
Investigate
Check all WordPress users (dashboard + database)
Review recent role and user changes
Check plugins and themes
Review activity logs (if available)
Check hosting and other privileged services
Remove
Confirm the account is truly unauthorized
Document relevant information
Remove unauthorized WordPress admin via dashboard or database
Reassign or handle their content appropriately
Re-check for additional unauthorized accounts
Prevent
Apply least privilege
Reduce unnecessary Administrator access
Remove former-user access
Review temporary privileges regularly
Use individual accounts with strong passwords
Maintain reliable backups
Schedule regular user-role audits
Example: Handling an Unexpected Administrator
Imagine a site with five users:
The unknown account should not be treated like the Editor.
The Editor may have excessive privileges; the unknown account may represent true unauthorized WordPress admin access. The distinction determines your response.
Frequently Asked Questions
How do I remove an unauthorized Administrator from WordPress?
First verify that the account is genuinely unauthorized. If you still have legitimate admin access, remove the unauthorized WordPress admin via Users → All Users (or via database/WP-CLI if hidden). Then review other users, credentials, plugins, themes, and hosting access.
Should I immediately delete an unknown Administrator?
Not necessarily. First determine whether the account belongs to a legitimate user. If it appears to be an unauthorized WordPress user, document relevant information and investigate for additional signs of compromise before deletion.
What if the Administrator is a former employee?
If the person no longer needs access, remove or reduce their WordPress privileges. Also review their access to hosting, domain management, email, and other website-related systems.
What if a legitimate user has Administrator access they don’t need?
Don’t delete the user. Reduce their role to one that matches their responsibilities (e.g., Editor, Author), or create a custom role if standard roles aren’t appropriate.
Can an unauthorized Administrator create another Administrator?
Yes. A user with sufficient privileges can create or modify accounts. That’s why you must review the complete user list — and the database — after discovering suspicious administrative access. fixmyhackedwebsite
Is an unfamiliar Administrator proof that WordPress was hacked?
No. It could be a legitimate but forgotten account or an administrative mistake. However, any unexplained administrative access should be investigated rather than ignored.
What should I do if I can no longer access my WordPress Administrator account?
Secure the associated email and other administrative systems first, then use a trusted account-recovery process or contact your hosting provider. If you suspect a compromise, consider professional security assistance.
How can I prevent unauthorized Administrator access in WordPress?
Limit the number of Administrators, use individual accounts, apply least privilege, protect privileged credentials with strong passwords and 2FA, remove unnecessary accounts, review access regularly, and keep WordPress, plugins, and themes updated.
Final Thoughts
Discovering unauthorized administrator access in WordPress requires more than simply deleting a user.
First, determine whether the account is genuinely unauthorized.
Then secure all legitimate privileged accounts and review the entire user list (including the database).
Remove unauthorized WordPress admin accounts or reduce excessive privileges.
Investigate how the access appeared and whether other parts of the website were affected.
The key principle:
Don’t treat a suspicious Administrator as an isolated user-management problem until you’ve ruled out a broader security incident.
A clean WordPress user list is valuable, but it’s only one part of strong WordPress admin security. Combine controlled Administrator access with:
Regular role audits
Strong authentication (passwords + 2FA)
Least-privilege permissions
Timely updates and backups
Monitoring and logging
That creates a much stronger foundation for protecting your site from WordPress unauthorized admin access and future compromises.
Discover more from WORDPRESS ROLE
Subscribe to get the latest posts sent to your email.