Securing the WordPress Administrator User Account

The WordPress administrator account is the most targeted account on your WordPress because it has full privileges. The WordPress administrator can do anything on a WordPress site (or multisite) such as install and activate themes, disable, enable, upgrade and modify plugins, create and move widgets, edit source code files, create new users, modify existing WordPress user accounts and more.

Therefore when securing a WordPress site, you should also secure the WordPress administrator account and ensure it remains secure. This WordPress security article explains how you can secure your WordPress administrator account and what you can do to ensure it remains secure.

Rename WordPress Administrator Account

A recommended security best practise is to rename the default WordPress administrator account. No need for anything fancy, a mix of alphanumeric characters (numbers and letters) should suffice. It is important to not use any default and common usernames for your WordPress administrator account such as admin, administrator, root, superuser etc.

By renaming your WordPress administrator account you are also protecting your WordPress site from dictionary and brute force attacks as explained in Protect Your WordPress from Brute Force Attacks.

For more information on how to rename a WordPress username, refer to Rename the Default WordPress Administrator account.

Change the WordPress Administrator User ID

Once you rename the default WordPress administrator you should also change the WordPress Administrator user ID. If you do not change the WordPress administrator user ID, anyone can easily find out the username you are using for the built-in default WordPress administrator, therefore renaming it only is not enough.

Hide the WordPress Administrator Username

Now that you have renamed the WordPress administrator account and changed the WordPress administrator user ID, you have made it difficult for the attacker to guess the WordPress administrator username. Therefore it will take him longer hence the chances of you identifying such suspicious behaviour and take evasive actions are much higher. Though it is still not enough since if you are not around to take evasive action, then the attacker might have enough time to guess the WordPress administrator user. In this case we also recommend you to hide the WordPress administrator display name.

Other Tips to Keep Your WordPress Administrator Account Secure

To ensure you keep your WordPress administrator account secure and unreachable from malicious hackers, follow the below tips:

1. Enable WordPress HTTPS for the login pages to ensure that your WordPress administrator and users credentials can never be captured and exposed, as explained in Hacking the WordPress login.
2. You should only have one WordPress administrator account and assign the least possible privileges to other WordPress user. Use WordPress roles wisely, as explained in Use WordPress Roles for Improved WordPress Security.
3. Only use the WordPress administrator account when its privileges are needed, for example when you need to install or update a plugin, when you need to modify the settings of a plugin or update the WordPress installation.
4. Do not write any content such as blog posts and WordPress pages and publish them with the WordPress administrator account. If you do the WordPress administrator username will be disclosed, thus making it easier for a malicious attacker to launch a targeted dictionary, or password brute force attack.
5. Do not share your WordPress administrator account credentials. If a developer needs administrator access to your WordPress site, create a temporary administrator account for the developer and once the project is ready, delete such account. It is also important to use a WordPress security monitoring plugin such as WP Activity Log to track the activity of third party contractors.
6. Last but not least, use a strong password for your WordPress administrator account and for all other WordPress user accounts. You can use a WordPress password policies plugin to ensure all WordPress users are using strong passwords.

Keeping the WordPress Administrator Account Safe

Similar to WordPress security, or any other form of security, securing the WordPress administrator account and ensuring it remains secure is not just a one time procedure, but a continuous process. Follow the tips in this article to ensure that all the hard work and money you invested to secure your WordPress blogs and websites is not poured down the drain.