Administrators you don't recognise, found and taken down a level
List everyone who can manage your whole site, spot accounts you don't know, lower their role with your password, and send password resets where needed.
- Difficulty
- Intermediate
- Time
- about 15 min
List the users who can manage my whole site, with when each joined. I don't recognise [username]: change their role to [subscriber] once I approve with my password. For [a colleague's username], send a password reset email once I approve. Then tell me what else to check, such as a security scan and my hosting account.
Already connected?
If SAR is already in your AI app, this is enough:
List my administrators and lower [username]'s role once I approve.
What happens
- The AI app lists the users with their roles and when they joined; emails are shortened and passwords are never available.
- It reads which roles can manage the whole site and how many users have each.
- Changing a role is approved in SAR with your password when administrator-level access is taken. It is never done to the connected account or the last administrator, and it can be undone.
- Sending WordPress's own password reset email is approved with your password. The current password keeps working until the person chooses a new one.
Approvals involved
Worked out from the tools this recipe uses.
wordpress_list_usersList usersNonewordpress_list_rolesList rolesNonewordpress_change_user_roleChange a user's roleDepends on the changewordpress_send_password_resetSend a password resetApproval and password
What you get
No unknown administrator left with full access. An unknown administrator can be a sign of a break-in: keep the account until whoever runs your hosting has looked, and run your security plugin's scan.
Related recipes
- Security & backups · about 10 minA former employee's account removed, their posts keptWhen someone leaves, find their account and either lower its role for now or delete it, with their posts and pages handed to a colleague.
- Security & backups · about 15 minA staff account that may be compromised, moved to a new email and resetWhen a colleague's mailbox may have been taken over, move their site account to a new email, send a password reset and look at recent login attacks.
- Security & backups · about 10 minCheck your WordPress files for tamperingCompare WordPress's own files and your WordPress.org plugins with the official copies, and find out whether anything was changed or is missing.
Try it on your own site
Install the plugin, add SAR to your AI app and paste the prompt. Free to start.