Every homeowner has a recurring nightmare: what if someone else is living in the house and we simply haven’t noticed? In the loft, in the cellar, without a sound. They have a key, they come and go, they eat from the fridge – but we never run into them.
In the world of websites, by 2025 this nightmare had become reality.
“Invisible administrators” (ghost admins) are one of the sneakiest forms of attack this year. Hackers have worked out that if they break into a website and wreck it straight away (say, by putting a skull and crossbones on the homepage), the owner notices immediately and removes them. But what if they create a secret admin account and quietly lie low? Then they can come back for months, even years, to steal data or send spam.
How could I possibly miss a new admin?
Most website owners believe a security check means logging in to the WordPress dashboard, clicking “Users” and, if they see only themselves, concluding that all is well.
In 2025, unfortunately, that is naive.
Modern attack code doesn’t just register a user. It can manipulate the way WordPress lists users. In effect, it “tells” WordPress: “When you list the admins for the owner, leave me (the hacker’s account) out.”
So you look at the list and see 2 administrators. In reality there are 3. The third has full permissions to everything – it has simply made itself invisible in the interface.
Technical details: how does the disguise work?
(This section is for developers and anyone interested in IT security)
In 2025, ghost admin attacks became technically more sophisticated. These are the most common tricks:
SQL injection (writing directly to the database): the attacker doesn’t use the registration form but exploits a vulnerability to write themselves straight into the
wp_usersandwp_usermetadatabase tables. That way theuser_registerhook never runs, so you get no email notification about the new registration.pre_user_querymanipulation: the hacker places a small snippet infunctions.phpor in a mu-plugin that modifies the user query. For example:WHERE ID != 123. The WordPress admin area then simply doesn’t load that user into the list.Hidden meta attributes: on paper, the user’s role isn’t “Administrator” but some custom name – which has nonetheless been given the
all_caps(all permissions) capability. Because many admin screens filter the list by role, this user “drops out” of view.
What names do intruders use?
Hackers used to be lazy and picked names like hacker123 or pwned. Those stood out immediately.
Today psychological warfare is in fashion. They choose names you’ll assume are part of the system, so you won’t dare delete them. Typical examples from 2025:
wp_update_systembackup_service_userhosting_support_helperauth_token_manager
If you see one of these (in the database, for example) and don’t remember creating it, you almost certainly have a problem.
The WPShield approach: why a machine beats the naked eye
Because what we see in the WordPress admin area no longer necessarily reflects reality, you need a tool that can “see behind the walls”.
One of the most useful – yet often unseen – features of the WPShield plugin tackles exactly this problem.
Our system doesn’t rely on WordPress’s manipulable list; it runs its checks directly in the database. We know that in the life of a typical business, new administrators are rare. Nobody hires a new IT person every day.
That’s why WPShield automatically checks the number of users with administrator rights every day.
If there were 2 admins yesterday…
…but today the system finds 3 deep in the database…
…then we alert you straight away, whether or not the new user has hidden itself from the list.
This feature can be a lifesaver, because you find out about the “uninvited guest” when they break in – not months later, after your customer database has already been stolen.
What should I do if I find a suspicious user?
Don’t delete it straight away (in a panic)! That’s the first instinct, but first take a backup of the database and note down the suspicious user’s details (when it was registered, with which email address). This is evidence.
Change passwords! Immediately change the passwords of all the other, genuine admin accounts, because you can’t know which one was compromised.
Force a log-out: using WPShield or another security tool, log every active user out of the system.
Professional clean-up: if there was a hidden admin, there is probably also a hidden backdoor file somewhere on the system that lets them create a new one at any time. Deleting the user on its own only treats the symptom – the hole has to be closed too.
Frequently asked questions
Why don’t I get an email from WordPress when the hacker creates the user?
Because WordPress only sends an email when the official registration process is followed. By 2025 hackers routinely bypass it and “inject” the user directly into the database, so alerting systems stay silent – unless you use a plugin (such as WPShield) that watches for changes in state rather than events.
Does two-factor authentication (2FA) protect me against this?
Partly. 2FA protects your account from being taken over. But if your website has a vulnerability (for example in an out-of-date plugin) that lets a hacker create an account for themselves, they will have their own password (and possibly their own 2FA). So 2FA matters, but it doesn’t protect against software vulnerabilities.
How can I see the “real” list without a plugin?
If you have access to phpMyAdmin in your hosting control panel, open your website’s database and find the wp_users table. That is the “raw” reality. If you see more rows there than the admins visible on the website, you definitely have a user in hiding.
Will WPShield alert me even when I create a new admin myself?
Yes. Our system follows the “zero trust” principle. Every new account with administrator rights is a potential risk. If you created it for a colleague, you can simply ignore the alert – but at least you know the system is awake and watching.
Not sure how many people have a key to your website?
Let WPShield look after your website and keep your business safe with 24/7 automated monitoring.
