WP Clinic
Log in Sign up

SECURITY FINDING

Unrecognized new WordPress administrator account

What it is

A new administrator account was found that doesn't look like it was part of the site's original setup — a common sign that an attacker who broke in created full access for themselves.

How to fix it

If you or your team created it on purpose, no action is needed. If you don't recognize it, remove it immediately and change every password — an unrecognized admin account usually means the site was already compromised.

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.