Admin account monitoring — catch the backdoor account, not just the backdoor file.
After a break-in, persistence is rarely a file — it’s an account. Relvato reads your administrator roster through the plugin, and flags any account that holds administrator plus a customer or subscriber role, or an administrator registered in the last two weeks.
- ✓No account holds administrator plus a customer or subscriber role
- ✓No administrator appeared in the last 14 days without you knowing
- ✓The total number of admins, every run, so a quiet climb is visible
- ✓Re-checked the moment a role changes — not just on a schedule
The WooCommerce skimmer playbook doesn’t leave an obvious admin called “hacker”. It takes an existing shopper account and adds the administrator role, so the account keeps its customer label and reads as one more buyer in a list of thousands. A malware scanner looking for changed files never sees it, because nothing on disk changed. Watching the roster is what catches it — and the moment a role changes, Relvato re-checks rather than waiting for the nightly pass.
- The plugin reports the roster — login, display name, roles, signup date and the email domain. Never full email addresses.
- An account holding administrator AND a customer or subscriber role fails the run: that combination is an elevation, not a new hire.
- An administrator registered in the last 14 days is surfaced for you to confirm — you approve it once, or you pull it.
Does Relvato read my users’ personal data?
No. The plugin reports each administrator’s login, display name, roles, signup date and the domain part of the email — never the full address, never anyone’s password, and never accounts below administrator.
Why is “administrator + customer” treated as an issue?
Because that’s an elevation, not a normal setup. A real administrator is created as one; a shopper account that suddenly also holds administrator was almost always granted it by someone who got in. It also hides well — your Users list still shows “Customer”.
I added a new admin myself. Will it keep alerting?
No. A brand-new administrator is a warning, not a failure, and it stops once the account is older than two weeks — or straight away if you mark the finding as reviewed.
Does it work without the WordPress plugin?
No. Account roles only exist inside WordPress, so this check needs the free Relvato plugin (1.3.0 or newer). Checks that look at your pages from the outside don’t.
Put this check on autopilot.
Free forever on one site — 3 journeys, 100 runs a month. No card, no sales call.