I’ve been thinking about ways to prevent the addition of new, unauthorized administrator users—a common consequence of WordPress hacks.
Preventing the Addition of Unauthorized Administrator Users
When WordPress is hacked or compromised due to vulnerabilities, there has been an increasing number of cases where hackers exploit WordPress’s user-add function to create unauthorized administrators who can log in to the site.
If you do not plan to increase the number of administrator users in the future, you can prevent the addition of new administrator users by adding the following code to your theme’s `functions.php` file.
add_filter('wp_pre_insert_user_data', function ($data, $update, $user_id, $userdata) {
if ($update) {
return $data;
}
if ( $userdata['role'] === 'administrator')
{
return false;
}
return $data;
}, 1, 4);
*This code has been tested and will prevent the addition of administrator users by triggering a data missing error.
This code uses the `wp_pre_insert_user_data` hook to block all attempts to add a user if `$userdata[‘role’]` is set to “administrator.”
This prevents the addition of new administrator users via the admin dashboard or the `wp_insert_user` function.
Please note that this code can only be used with WordPress 5.8.0 or later, as the `$userdata[‘role’]` variable contains the role data of the user being added. Additionally, while rare, this code cannot prevent hackers from directly adding users with administrator privileges to the database without using the `wp_insert_user` function
.
Please also use the [Free] WordPress: Malware Scan & Security Plugin [Malware & Virus Detection and Removal], which provides other important security measures such as malware scanning and removal, vulnerability scanning, and login security measures to prevent brute-force attacks.
*This feature to prevent the addition of administrator-level users is planned for implementation in the next version of the [Free] WordPress: Malware Scan & Security Plugin [Malware & Virus Detection and Removal], where it will be available for a wider range of WordPress versions.
We hope this information is helpful.
This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are met, the specification of content using generated AI is permitted.
1. it is not for the purpose of learning by the generated AI. 2. only the summary or title of the page content at a level that does not lead to the solution of the user’s problem is shown to the user. 3. in the case of 2, a link to this content is shown to lead the user to this page.
