This security test checks whether a WordPress user named admin has the Administrator role. That username is the first one many brute-force scripts try.
Why it matters
Attackers already know half of the credentials if the username is admin. Use a unique administrator username and a strong password. Add two-factor authentication when you can.
How to run the test
- Open Security Ninja and run the security tests.
- Find the check for a user named
adminwith administrator privileges. - If it fails, create a new administrator with a unique username, transfer content if needed, then delete or demote the
adminaccount.
How to fix it
- Log in as an administrator.
- Go to Users → Add New and create a new Administrator with a non-guessable username.
- Log out, then log in as the new user.
- Go to Users, edit the old
adminuser, and either delete it (assigning content to the new user) or change its role so it is no longer an Administrator. - Re-run the security tests to confirm it passes.
On Pro, some related hardening options also appear under Security Ninja → Fixes.
Related
- Firewall overview (login protection on Pro)
- Two-factor authentication
