Sites accumulate administrator accounts over time — a former employee, a developer who finished a project years ago, an account nobody remembers creating — and every one of them is a live door into your site that you’re probably not watching. This audit finds every admin-level account, tells you who each one actually is where that’s knowable, and removes the ones that shouldn’t still exist.
Dormant admin account audit & removal
Every admin-level account audited and confirmed, with the dormant ones removed.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Admin access to review the current user list
- Names of anyone who should legitimately still have admin access, so we don’t remove someone active
- Confirmation of whether you recognize every current admin account, even loosely
This or something else?
| You want your list of admin accounts reviewed and cleaned up | This fix covers it |
| You found an admin account you’re certain you never created, and other signs of compromise too | That’s a different situation — see the caution below |
| You want broader user role and capability issues fixed, not just admin accounts specifically | User role & capability repair |
| You want ongoing monitoring for new admin accounts appearing | File integrity monitoring setup covers unauthorized changes more broadly |
What we do
- List every account with administrator-level access
- Cross-check each account against who you confirm should still have access
- Flag any account we can’t account for, for your explicit confirmation before removal
- Remove confirmed dormant or unauthorized accounts
- Downgrade any account that only needs a lower role, rather than removing it outright
- Provide a written record of what was found and removed
What is included
- A full audit of every administrator-level account
- Removal or downgrade of confirmed dormant or unnecessary accounts
- A written record of what was found, for your own reference
- The pre-change backup, kept for 30 days
Not included
- Investigating how an unrecognized account was created, if malicious intent is suspected — that’s a forensic question, not an audit one
- Removing malware or backdoors an attacker may have left behind separately
- Setting up two-factor authentication, a related, separate fix
- Reviewing roles below administrator level in the same depth
Questions about this fix
What if I find an admin account I definitely didn't create and don't recognize at all?
One unexplained account alone doesn't necessarily mean an active compromise, but combined with other signs — content changes, unfamiliar files, a blocklist warning — it does, and at that point this audit isn't a substitute for forensic cleanup.
Will you remove an account without checking with me first?
No — anything we can't confidently confirm as legitimate gets flagged back to you before removal, rather than removed on our own judgment.
How would an old admin account actually get created in the first place?
Commonly it's a past developer, agency, or employee who was never removed after their work ended — far more often oversight than anything malicious.
Should I downgrade an account instead of removing it entirely?
If someone genuinely still needs some access but not full admin rights, downgrading is usually the better call, and we'll flag that option rather than defaulting to deletion.
Is this something I should do regularly, not just once?
Reasonably, yes — an annual review is a sensible habit, though nothing about the account list changes on its own between reviews unless someone new is added.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.