If administrator users are being created on your WordPress website without your authorisation, even though it is updated to the latest version, your installation has probably been compromised. These security breaches are critical and must be addressed immediately to prevent further damage, such as losing control of the site or having information stolen.
Below, we explain step by step how to solve this problem and prevent future attacks.
1. Change all passwords
The first thing is to make sure that no attacker can continue accessing your system:
- Change the WordPress administrator password.
- Change the database user password (MySQL).
- Change your FTP/SFTP access passwords.
- Change the password for your hosting control panel (such as cPanel, Plesk, DirectAdmin or InterWorx).
2. Remove suspicious users
Go to Users > All Users in the WordPress administration panel. Check the administrator-role users one by one. Delete any account you do not recognise or that has unusual or suspicious names.
3. Check the functions.php file
The active theme’s functions.php file is one of the places where attackers often insert code to create users automatically.
- Open
wp-content/themes/whatever-you-called-your-child-theme/functions.php. - Look for functions such as
wp_create_user,create_user,add_user_to_blogor similar. - If you find code that you did not add, delete it immediately after making a backup.
4. Reinstall WordPress
Even if your installation is up to date, WordPress core files may have been modified. To make sure they are clean:
- Go to Dashboard > Updates.
- Click the “Reinstall Now” button.
This will replace the core files without affecting your content.
5. Scan the site for malware
Use a security plugin to scan your site for malicious files or suspicious behaviour. Some recommended options are:
These plugins can detect backdoors, modified files and scripts that allow unauthorised user creation.
You can also contact a company specialising in WordPress development and security, such as Impulsa3. Our technicians will help you regain control of your site.
6. Manually review the site files
Some attackers insert scripts in unusual locations. Examine these carefully:
wp-config.php.htaccess- Files in
wp-content/themes/andwp-content/plugins/ - Files with unusual names or files modified recently
It is also advisable to review the contents of the uploads directory, although it should not normally contain executable scripts.
7. Review the access logs
If your server has access logs enabled, review the IP addresses and URLs requested recently. This will allow you to identify attack patterns and possible entry points.
8. Disable user registration if you do not need it
Many sites do not require visitors to register. To prevent attackers from exploiting registration forms:
- Go to Settings > General.
- Make sure that the “Anyone can register” option is disabled.
9. Implement a web application firewall (WAF)
A web application firewall helps block attacks before they reach WordPress. Some options are:
- Cloudflare (with security rules enabled)
- Sucuri Firewall
These services also offer protection against DDoS attacks and automated scans.
10. Configure two-factor authentication (2FA)
Enabling two-factor authentication for administrators and users with elevated permissions adds an additional layer of security. You can use plugins such as:
- Wordfence (includes built-in 2FA)
- WP 2FA
11. Keep WordPress, plugins and themes up to date
It is essential to keep the entire ecosystem up to date to fix known vulnerabilities. Enable automatic updates or carry out regular reviews of:
- WordPress core
- Plugins
- Themes
12. Change the database table prefix
During installation, WordPress uses the wp_ prefix for tables by default. Changing this prefix makes some automated attacks more difficult.
This change requires editing the wp-config.php file and all database tables, so it is advisable to make a backup before proceeding.
13. Restore a clean backup
If you have access to a backup from before the problem occurred, consider restoring it. Make sure to clean out any malicious code before bringing the site back online.
Conclusion
The appearance of unauthorised administrator users in WordPress is a clear sign that your site has been compromised. Acting quickly is key to containing the damage, removing backdoors and preventing future attacks. In addition to solving the current problem, it is essential to implement permanent security measures to protect your site in the long term.
One aspect that many users overlook is the unnecessary exposure of real usernames through SEO tools. For example, if you use plugins such as YoastSEO, make sure to disable the author sitemap if your site does not have multiple contributors or you do not need to display author pages publicly. Publishing these sitemaps can allow attackers to identify valid system usernames easily, facilitating brute-force attacks or user enumeration.
WordPress security is not based only on tools, but also on the correct configuration and continuous monitoring of the environment. Review settings, logs and access regularly to ensure that your site is proactively protected.
