Why It Matters

Bots try to log in to WordPress sites all day, every day. They guess usernames and passwords from long lists, and “admin” is the first username they try because older WordPress installs used it by default.

If your site has a user called “admin”, an attacker already knows half of the login. They only need to guess the password. Removing that username makes every guess harder, and it costs you nothing.

Insight Bench for WordPress flags this as “A user named ‘admin’ exists”. The fix takes about ten minutes.

Before You Start

  • Take a backup. Deleting a user changes who owns posts, pages and media. A fresh backup of the database means you can undo a mistake. Many hosts offer one-click backups in their control panel.
  • Check what uses the “admin” account. Some sites connect services through a specific user: a backup plugin, a form plugin that emails that user, an app password, or a WooCommerce store’s notifications. Look at Users → Profile while logged in as “admin” and note anything set up there, such as application passwords.
  • Have a second email address ready. WordPress won’t let two users share an email address. Either use a different address for the new account, or change the email on the “admin” account first (Users → Profile → Email) to free up the one you want.

Step 1: Create a New Administrator

  1. Go to Users → Add New User (called Users → Add New on older versions).
  2. Choose a username that isn’t easy to guess. Avoid “admin”, “administrator”, your domain name, your business name and your first name on its own.
  3. Enter the email address for the new account.
  4. Click Generate password or type a long, unique password. A password manager makes this easy. Aim for at least 16 characters and don’t reuse a password from anywhere else.
  5. Set Role to Administrator.
  6. Click Add New User.

Step 2: Log In as the New User

Log out (top right, under your name), then log in with the new username and password. Check you can reach Settings, Plugins and Users. If you can, the new account works as an administrator.

Don’t delete “admin” until you have done this. Deleting your only working administrator account can lock you out of the site.

Step 3: Delete “admin” and Keep Its Content

  1. Go to Users → All Users.
  2. Hover over the “admin” row and click Delete.
  3. On the next screen, select Attribute all content to: and choose your new user from the list.
  4. Click Confirm Deletion.

All posts, pages and other content owned by “admin” now belong to the new user. Nothing is removed from the site.

Step 4: Protect the New Account

A new username helps, but the password and a second login step matter more.

  • Turn on two-factor login. A plugin such as “Two Factor” (from the WordPress.org plugin directory) or the login security features in Wordfence or Solid Security can ask for a code from an authenticator app after the password. Set it up for every administrator, not only yourself.
  • Limit login attempts. Most security plugins can slow down or block repeated failed logins. Some hosts do this for you.
  • Review other users. While you are in Users → All Users, filter by Administrator. Remove people who no longer need access, and lower others to Editor or Author if they only write content.
  • Check the public name. Under Users → Profile, set Display name publicly as to a real name or nickname, so the username isn’t shown on posts.

Check It Worked

  • Users → All Users no longer lists “admin”.
  • Open a few posts that used to belong to “admin” and confirm they show the new author and still load normally.
  • Log out and log back in as the new user, including the two-factor step.
  • In Insight Bench (or in the plugin), press Re-scan now to confirm the warning has cleared.

Common Pitfalls

  • Deleting “admin” while logged in as “admin”. WordPress won’t allow it from that account anyway. Always log in as the new administrator first.
  • Picking “Delete all content”. This removes the old user’s posts and pages. Choose Attribute all content to instead. If you make this mistake, restore your backup.
  • Reusing the old password. If “admin” had a weak or shared password, don’t carry it over to the new account.
  • Forgetting multisite. On a WordPress multisite network, users are managed under My Sites → Network Admin → Users, and a super admin must be replaced there.
  • Treating the username as a secret. WordPress builds author page addresses (such as /author/yourname/) from the username, so it can still be seen. A less obvious username removes the easiest guess; the password and two-factor login are what keep people out.