Admin account monitoring — catch the backdoor account, not just the backdoor file.
After a break-in, persistence is rarely a file — it’s an account. Relvato reads your administrator roster through the plugin, and flags any account that holds administrator plus a customer or subscriber role, an administrator registered in the last two weeks, or an application password on an administrator that you didn't create. It reads accounts straight from the database (plugin 1.24.0+), so an administrator hidden from your Users screen is caught too — and so is an account with administrator powers under another role name.
- ✓No account holds administrator plus a customer or subscriber role
- ✓No administrator hidden from your Users screen
- ✓No administrator-level powers under another role name without you knowing
- ✓No administrator appeared in the last 14 days without you knowing
- ✓Every administrator listed once for you to confirm, so an account an attacker made before Relvato started watching doesn't pass as normal
- ✓No application password on an administrator that you didn't create
- ✓No WooCommerce REST API key or OAuth app you don't know about: sign-in keys that skip the login form and 2FA
- ✓The total number of admins, every run, so a quiet climb is visible
- ✓Re-checked the moment a role changes or an application password is created — not just on a schedule
The WooCommerce skimmer playbook doesn’t leave an obvious admin called “hacker”. It takes an existing shopper account and adds the administrator role, so the account keeps its customer label and reads as one more buyer in a list of thousands. A malware scanner looking for changed files never sees it, because nothing on disk changed. Application passwords are the quieter version: since WordPress 5.6 an administrator can have passwords that sign in to the REST API directly, so two-factor login, login limits and a changed password never touch them. Watching the roster is what catches both — and the moment a role changes or an application password is created, Relvato re-checks rather than waiting for the nightly pass. The most careful attackers go one step further and hide their administrator from the Users screen with a few lines of code. The account is still in the database, and that’s where Relvato reads it.
An administrator nobody remembers creating is how many infections get back in after a clean-up. Our guide shows where WordPress malware hides and what to change so it stays gone.
- The plugin reports the roster — login, display name, roles, signup date and the email domain. Never full email addresses.
- Accounts are read straight from the database, not through WordPress’s user list — so an administrator the Users screen has been made to hide still shows up, and fails the run. An account with administrator-level powers under another role, or granted to it directly, is listed for you to confirm.
- An account holding administrator AND a customer or subscriber role fails the run: that combination is an elevation, not a new hire.
- An administrator registered in the last 14 days is surfaced for you to confirm — you approve it once, or you pull it.
- Each administrator's application passwords are listed by name and date — never the password. One created in the last 14 days fails the run; older ones are listed once each for you to confirm.
Does Relvato read my users’ personal data?
No. The plugin reports each administrator’s login, display name, roles, signup date and the domain part of the email, plus the name and dates of each application password — never the full address, never a password, and never accounts without administrator-level access.
Why is “administrator + customer” treated as an issue?
Because that’s an elevation, not a normal setup. A real administrator is created as one; a shopper account that suddenly also holds administrator was almost always granted it by someone who got in. It also hides well — your Users list still shows “Customer”.
I added a new admin myself. Will it keep alerting?
No. A brand-new administrator is a warning, not a failure, and it stops once the account is older than two weeks — or straight away if you mark the finding as reviewed.
How can an administrator be hidden from the Users screen?
WordPress builds the Users screen with a query any plugin can filter, and malware uses that to leave its own account out of the list and out of the admin count at the top. Relvato reads accounts straight from the database and compares that with what the Users screen shows: an administrator that exists but isn’t listed fails the run. If you hide an account on purpose (some security plugins do), ignore the finding once. Hiding done only in the browser, with CSS or JavaScript, isn’t visible to the server — but the account still appears in Relvato’s list, where you can spot one you don’t know.
Does it work without the WordPress plugin?
No. Account roles only exist inside WordPress, so this monitor needs the free Relvato plugin (1.3.0 or newer; 1.24.0 or newer to catch hidden administrators). Monitors that look at your pages from the outside don’t.
What is an application password, and why does it matter?
It's a password WordPress (5.6 and newer) lets an administrator create for apps and integrations — the mobile app, Jetpack, Zapier. It signs in to the REST API without the login form, so two-factor login and login limits don't apply, and changing the account password doesn't revoke it. That makes one an attacker adds a way back in after a clean-up. Relvato lists each one by name and date; you confirm the ones you know, and a new one fails the run.
Put this monitor on autopilot.
Free forever on one site — 100 runs a month, started by you or weekly, no card. Pro re-runs your monitors by itself after every update.