Remove Unwanted WordPress Admin Users

The Problem

You've spotted an admin user you don't recognise, an old account that should have been removed long ago, or you want to tidy up who actually has full access to your site — and removing a user incorrectly can accidentally delete content tied to that account.

About this problem

An unfamiliar admin account can mean a few different things: a leftover account from a previous developer or agency that was never removed, a default account created during setup, or in more concerning cases, a sign of unauthorised access. Each needs a slightly different approach, and simply deleting a WordPress user can also delete or orphan any content authored under that account if it's not reassigned first.

This is worth doing proactively as routine hygiene, not just when something looks wrong — every admin account is a potential way in if its password is ever compromised.

What's Included

• Reviewing all existing user accounts and their roles
• Reassigning any content (posts, pages) owned by accounts being removed, so nothing is lost
• Safely removing the unwanted account(s)
• A quick check for signs the account was used for anything suspicious, if that's a concern

What's NOT Included

• A full security audit or malware scan (separate service if you suspect a genuine compromise)
• Changing passwords for accounts you're keeping — that's something you can do yourself in a minute
• Investigating who created the account beyond what's visible in WordPress's own logs

How It Works

1. Review the full list of user accounts and their roles to confirm which ones are unwanted or unrecognised.
2. Check what content, if any, is authored under the account(s) being removed.
3. Reassign that content to the correct remaining user before deleting the account, so nothing disappears.
4. Remove the unwanted account(s) and confirm the user list reflects only accounts you recognise.
5. If anything about the account looked suspicious, flag specific signs worth a closer look.

In practice: you buy the service, send over whatever access or details the job needs, I investigate and do the work, and you confirm it's resolved before we call it done.

Frequently Asked Questions

Is it safe to just delete an admin account I don't recognise in WordPress?

Not immediately — if that account authored any posts or pages, deleting it without reassigning that content first can delete or orphan it, so it's worth checking before removing.

How do I know if an unknown admin user means my site was hacked?

Not every unfamiliar account is malicious — it's often a leftover from a previous developer — but combined with other signs (unexpected plugins, changed settings) it's worth a closer look, which I can flag during the review.

Will removing an old admin account delete my website content?

No, as long as any content it authored is reassigned to another user first, which is part of the process rather than an afterthought.

How many admin accounts should a WordPress site actually have?

As few as practical — ideally one per person who genuinely needs full access, since every admin account is a potential point of failure if its credentials are ever compromised.

Can I just change an unknown user's role instead of deleting them?

You could, but if the account is genuinely unwanted rather than needed at a lower permission level, removing it outright is cleaner and safer.