What it is

One of the administrator accounts uses a predictable username, such as "admin" or the site's domain name — handing an attacker half of the login they need to break in by password-guessing alone.

How to fix it

Create a new administrator account with a unique username, move over anything tied to the old one, then remove the default account.

In depth

Your WordPress site has an administrator account using the username "admin," which is the first username hackers try when attempting to break into a site. Because this username is so common and obvious, attackers only need to guess your password to get in, rather than having to figure out both your username and password. This significantly increases the risk that someone could gain control of your entire website through repeated login attempts. To fix this, you need to create a brand new administrator account with a username that's unique and hard to guess, something like "sarah_admin_2024" rather than just "admin." After you set up this new account, you should log in using it, move any important content or settings associated with the old admin account to your new one, and then delete the default "admin" account entirely. This removes the easy target that attackers are looking for and makes it much harder for anyone to break into your site.