There's an Admin User on My WordPress Site I Didn't Create

What's happening

An administrator account you didn't create almost always means someone else has a key to your site. Administrators can do anything: install plugins, edit pages, add more users, and change the email address that password resets go to. An attacker makes their own admin account so they can keep getting in, even after you change your password.

Look at Users in your dashboard. The warning signs are a username you don't recognise, an email address at a domain you've never heard of, a registration date that doesn't match anyone's work on the site, or a display name that copies a real one, like a second "admin". Sometimes the account is set up so it doesn't show in the list at all, which is why a clean-looking Users screen isn't proof on its own.

Why it happens

The account itself is not the break-in. It's what the attacker did once they were in. The usual ways in are an outdated plugin or theme with a known security hole, a weak or reused password that a bot guessed, or a login left open after someone's computer was infected. Once inside, attackers add an admin account, and often a hidden file that lets them back in later, so they still have access after the obvious account is removed. For the bigger picture, see My WordPress site was hacked.

What you can safely try

• Change your own password now, and the passwords of every other real administrator. Use long, unique ones. If your hosting account shares the same password, change that too.
• Write down the account's details before you touch it: username, email address, registration date. They help whoever cleans the site work out when and how it happened.
• Check that your own account's email address is still yours. Attackers sometimes change it so password resets go to them.
• Don't delete the account yet. If you do, WordPress asks what to do with its content, and the hidden way back in stays behind. Removing the account is part of a cleanup, not a substitute for one.
• Don't install several security plugins at once to scan for it. They can clash, and a scan that says "clean" can give false comfort.

When to call us

A site with an unknown administrator needs a proper cleanup, not just a deleted user. We work on business websites. We find every account and file that doesn't belong, remove them, close the hole that let the attacker in, and reset access so only your people have it. If Google has started warning about the site, we handle that too. It's a flat rate you approve before any work starts. Start with our Hacked Site Cleanup.