Administrators you don't recognise, found and taken down a level
List everyone who can manage your whole site, spot accounts you don't know, lower their role with a 6-digit code, and send password resets where needed.
- Difficulty
- Intermediate
- Time
- about 15 min
List the users who can manage my whole site, with when each joined. I don't recognise [username]: change their role to [subscriber] once I approve. For [a colleague's username], send a password reset email once I approve. Then tell me what else to check, such as a security scan and my hosting account.
Already connected?
If Mitos is already in your AI assistant, this is enough:
List my administrators and lower [username]'s role once I approve.
What happens
- The AI assistant lists the users with their roles and when they joined; emails are shortened and passwords are never available.
- It reads which roles can manage the whole site and how many users have each.
- Changing a role is approved with a 6-digit code as an extra check that it's really you, when administrator-level access is taken. It is never done to the connected account or the last administrator, and it can be undone.
- Sending WordPress's own password reset email is approved with a 6-digit code as an extra check that it's really you. The current password keeps working until the person chooses a new one.
Approvals involved
Worked out from the tools this recipe uses.
wordpress_list_usersList usersNonewordpress_list_rolesList rolesNonewordpress_change_user_roleChange a user's roleDepends on the changewordpress_send_password_resetSend a password resetApproval with a 6-digit code
What you get
No unknown administrator left with full access. An unknown administrator can be a sign of a break-in: keep the account until whoever runs your hosting has looked, and run your security plugin's scan.
Related recipes
- Security & backups · about 10 minA former employee's account removed, their posts keptWhen someone leaves, find their account and either lower its role for now or delete it, with their posts and pages handed to a colleague.
- Security & backups · about 15 minA staff account that may be compromised, moved to a new email and resetWhen a colleague's mailbox may have been taken over, move their site account to a new email, send a password reset and look at recent login attacks.
- Security & backups · about 10 minCheck your WordPress files for tamperingCompare WordPress's own files and your WordPress.org plugins with the official copies, and find out whether anything was changed or is missing.
Try it on your own site
Install the plugin, add Mitos to your AI assistant and paste the prompt. Free to start.