An administrator was created outside WordPress

An admin user with the username "wp_support_admin" was created outside of WordPress.

What Wordfence found

Wordfence looks for administrator accounts whose creation does not match what WordPress records. Typically the account was inserted straight into the database, bypassing the usual code path.

Why it matters

This is a persistence mechanism. An attacker who gains temporary access creates an administrator so they can return after the original hole is patched — which is why sites get reinfected weeks after a clean-up that looked complete.

How to fix it

1. 1Do not delete the account immediately. Note its username, email and registration date first.
2. 2Confirm with the site owner that nobody recognises it. Some management and hosting plugins legitimately create service accounts, and machine-generated names are not proof of malice on their own.
3. 3If unrecognised, delete it and audit all remaining administrators.
4. 4Rotate the passwords of every remaining administrator and regenerate salts to invalidate sessions.
5. 5Look for how the attacker got write access in the first place — this finding is a symptom.

Common questions

Could this account be legitimate?

Sometimes — hosts and migration tools insert admin accounts straight into the database, which trips exactly this check. If the username matches your host's support tooling or a migration you performed, and its creation date lines up, it can be legitimate. Verify with the host rather than assuming: confirming takes one ticket.

If nobody can explain it, what am I looking at?

A persistence mechanism. Attackers create their own admin account so that cleaning the original entry point does not evict them — the account is the backdoor. Its existence also means something already had database-level write access, so the account is the second finding, not the first.

Just delete the account?

Delete it, but do not stop there. Check what the account did (posts, plugin installs, file edits), find the write access that created it, rotate all admin credentials and the site's salts to invalidate any session cookies it minted, and re-scan. An unexplained admin account is the clearest single indicator of compromise Wordfence produces.

Findings that often appear with this one

• A user has an easily guessed password Login
• A file appears to be malicious Malware

How WPSecureOps treats it

The connector reports this as suspiciousAdminUsers, suspiciousAdmins. WPSecureOps files it under Login and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.

1. Wordfence: How to interpret scan results
2. WordPress Developer Resources: Hardening WordPress
3. Wordfence: If your site is hacked