How I Discovered the Hidden Threat

The Problem with Orphaned Admin Accounts

These accounts aren't just inactive; they're dangerous. Attackers target them because they combine high privileges with low monitoring. A leaked password from an old account can grant full admin access without triggering any security alerts. Since no one expects these accounts to log in, malicious activity can go unnoticed for months.

I've seen cases where orphaned accounts were used to inject malware, steal data, or even lock site owners out of their own sites. The scariest part? Many of these breaches could have been prevented with a simple audit.

How to Audit WordPress Admin Accounts

The first step is identifying every admin account on your site. Go to Users > All Users in WordPress and filter by the Administrator role. For each account, ask:

• Who is this person?
• Do they still need admin access?
• When was the last time they logged in?

WordPress doesn't show last login dates by default, so you'll need an activity log plugin like Nexu Activity Log. It tracks logins, IP addresses, and user activity, making it easy to spot dormant accounts.

Step-by-Step Audit Process

1. Export the admin user list - Note down every account with admin privileges.
2. Verify legitimacy - If you can't identify the user or their role, flag the account for removal.
3. Check last login dates - Accounts inactive for 90+ days are high-risk.
4. Review activity logs - Look for unexpected logins or suspicious behavior.
5. Demote or delete - Remove unnecessary admin access immediately.

Automating the Solution

Manual audits help, but the real fix is automation. I now use Nexu Activity Log to:

• Alert me when new admin accounts are created - Instant notifications for unauthorized changes.
• Track login locations - Flag logins from unfamiliar IPs or countries.
• Monitor dormant accounts - AI-powered alerts for accounts that suddenly become active.

Preventing Future Risks

The key is process. Add WordPress access revocation to your offboarding checklist. Schedule quarterly admin account reviews. Use temporary accounts with expiry dates for contractors. With the right tools and habits, orphaned admin accounts don't have to be a hidden threat.

Start your audit today. The security of your site depends on it.