What it is

A new administrator account was found that doesn't look like it was part of the site's original setup — a common sign that an attacker who broke in created full access for themselves.

How to fix it

If you or your team created it on purpose, no action is needed. If you don't recognize it, remove it immediately and change every password — an unrecognized admin account usually means the site was already compromised.

In depth

Our security scan discovered a new administrator account on your WordPress site that wasn't created during your initial setup. Administrator accounts have complete control over your website, so whoever can log in with those credentials can change your content, view sensitive information, or shut you out of your own site. If you or someone you work with created this account intentionally, you're fine, but unexpected administrator accounts are a common sign that someone unauthorized has accessed your site. Log into your WordPress dashboard immediately and delete any administrator accounts you don't recognize by going to Users, clicking on the account name, and selecting Delete. After you've removed the suspicious account, change the passwords for all your remaining user accounts and consider running a full security scan to check for other signs of unauthorized access.