Preserve before revoking
- record user ID, name, role, and email
- capture creation and modification times
- list active sessions and application passwords
- preserve related logs and changes
Application passwords are revocable credentials for API integrations. They cannot be used like a dashboard password, but may preserve programmatic access through a compromised account.
Do not treat the account in isolation
Deleting one user does not remove file, database, or scheduler persistence. Account review is one part of incident analysis.
After preservation, revoke unauthorized accounts, sessions, and application passwords. Reset legitimate credentials, enable MFA for privileged users, and monitor for renewed account creation or role changes.
Is an unfamiliar administrator always malicious?
No. Agencies, hosts, maintenance vendors, or former staff may have created legitimate accounts. “Unknown” initially means that ownership and purpose have not been established. Confirm the responsible party, creation reason, and required role without using the account for further administration.
Risk rises when several facts align: an unexplained email domain, creation outside a known change window, administrator privileges without a business need, recent application passwords, or logins from unfamiliar networks. A legitimate account can also have been taken over.
Which evidence belongs in an account review?
Inspect WordPress user and user-meta records together with audit, web-server, WAF, and hosting logs. Useful events include login, password reset, role change, plugin installation, file editing, and API access. Application passwords have labels and may include usage metadata, but those fields are not a complete access history.
Correlate events with the incident timeline. If records are missing, say that the creator or use of the account could not be established.
What follows revocation?
Terminate sessions, revoke application passwords, and recreate legitimate access from a trusted device. Then review files, database content, scheduled tasks, and integrations for other persistence. Monitor new users and privilege changes.
Necessary service identities need one purpose, minimum privilege, a responsible owner, a review or expiry date, and unique secrets. The hardening checklist places those identity controls in the wider security baseline.