I have a client with a Wordpress website currently hosted on Siteground. They are worried that someone else has access to their Wordpress admin user account (only one user I can see in the back end) and also possibly their Siteground account.

I wanted to suggest just change passwords for both of these sites but wanted to confirm, would this be enough? Or create a new full admin account in Wordpress then delete the other altogether?

Is there a guaranteed way to remove any possible access to everyone but the client?

1 Answer 1


In principle, just resetting the password, plus invoke the "Log out everywhere else" on the user profile, should be enough to prevent benign user knowing the password. Reset the web host customer password, including any associated FTP account password. Use strong and unique passwords.

But, in case any unknown, possibly malicious user, may have had wp-admin, hosting account or FTP access, a backdoor may have been introduced through PHP code. In that case the site must be regarded hacked. See https://wordpress.org/support/article/faq-my-site-was-hacked/

Any custom PHP code should be reviewed to rule out a backdoor, plus wp itself and all plugins/themes reinstalled from scratch. This is not trivial, requiring an expert.

  • 1
    I have a process I use to clean hacked WP sites here: securitydawg.com/recovering-from-a-hacked-wordpress-site . It involves what was said in the above answer: change credentials everywhere (not just WP); reinstall from known good source all themes/plugins/WP, inspect all folders and files for added code (especially index.php and htaccess files); look for files that are 'out of place'. Takes some time and some knowledge, but can be done without a 'nuke from orbit'. Sep 24, 2019 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.