1

I have created several wordpress sites for different clients and I want to have easy access to each site. I could always ftp into the files or edit the database, but i want it to be easier. I want it to be secret so a client doesn't accidently delete my user. Does anyone have any ideas how i could have a secret admin level user or a plugin that is a backdoor.

Please believe me i'm not asking anyone to build this for me. I'm just asking for some ideas. like a brainstorming session. I have worked with lots of cms's but wordpress is still new. I thought there might be some veterans here that could point me in the right direction.

OH I FORGOT THE MOST IMPORTANT PART. I need this to be a plugin!!! and obviously it needs to stay active even if the client upgrades the core.

Any help/ideas would be great. Thanks.

OK i see I'm getting a lot of heat from everybody thinking I am trying to accomplish an unethical task. I apologize and hope that no one deletes this. I guess I will try ask my question a different way.

Lets be honest what can do i accomplish with this "secret user plugin" that i cannot accomplish with ftp and database access. I am the webmaster for each client. I setup the hosting. Half of them do not even have ftp log-in information. Nothing devious is happening I'm only trying to make my life easier.

|improve this question
  • possible duplicate of plugin to hide admin user – Rarst Jan 27 '11 at 21:46
  • 2
    First, what's to stop your client from deactivating the plugin? Second, this seems like a fishy request. Having a "backdoor" that your client doesn't know about is thoroughly unethical, and not the kind of thing I'd advise people to do, let alone HOW to do. Voting to close as it's a duplicate, and extremely suspect. – MathSmath Jan 27 '11 at 22:28
  • 1
    @MathSmath: I take it you're not delivering support to users who aren't always providing the needed login details when asking you to fix their sites asap. :-) – Denis de Bernardy Jan 27 '11 at 22:41
  • 1
    @John P Bloch - Looks like MathSmath wasn't viewing this a duplicate but instead an ethics issue. I currently agree 100% with @MathSmath's concern too because @user2774 hasn't given an explanation why it needs to be secret. – MikeSchinkel Jan 28 '11 at 2:27
  • 1
    I tend to agree with Mike and Rarst on this, and i think the problem was with how described what you're aiming to do, because it sounds like you want some secret level of access you have no intention of informing your clients about. Imagine this(maybe not the best example, but still), if you took your PC to a store to get fixed, and the individual who did repairs hid a backdoor application in the operating system so he/she could login and fix problems remotely in future(you've not been told, at least until you call when you have PC problems again). What would you think/feel at that point? – t31os Jan 28 '11 at 11:11
4

Just in case you still have FTP access, you can make use of WPAAA.PHP – WordPress Access All Areas (Wordpress Support Tool).

It's a single file and you can easily create a Must-Use plugin out of it by just copying it into the must-use directory and doing some hacks. Additionally, it will auto-configure itself so that you have a secret URL to access the page.

|improve this answer
  • FINALLY!!!!! Thank you so much!!! But you might want to watch your back. I think the lynch mob of towns folk will be out shortly with pitch forks and and torches! JK. I have enjoyed this debate. – Steve Fischer Feb 4 '11 at 13:41
1

Following up on John's comment, add a must-use plugin that:

On failed login, or on register, check for an arbitrary username/password of your choice (don't forget to hash the password in your plugin, since it'll be right there in clear text if not). If it matches, add that user/pass to the database with your email, grant him admin rights, and log him in.

At your option, on logout, check if it is that user/pass combo is logging out. And if so, delete him.

That way you'll be able to log in regardless of whether your super-admin login is in the users list.

Don't forget to protect the username, too. You don't want to create two users with the same username and different privileges.

An alternative can be a must-use plugin that sticks to protecting your username of choice: if it gets edited/deleted, reject the change before it occurs.

|improve this answer
  • 1
    I just don't see how this is anymore unethical than what I can do with ftp and database access. My only goal is to make my life a little easier – Steve Fischer Jan 27 '11 at 23:09
  • 3
    @user2774 - The concern I have is that you said "secret that your client does not know about." If you said "Visible to my client, but they can't break or change" then I'd be like "Sure, absolutely!" Is the latter what you really need? – MikeSchinkel Jan 28 '11 at 2:22
  • 2
    @John P Bloch - On multisite you can still see superadmins, you just can't delete them. Why does he want to hide them; I fear it might be for nefarious purposes? – MikeSchinkel Jan 28 '11 at 2:25
  • 1
    @Mike: Yeah, I actually do. I flirted with the idea of doing the same at one point. Users occasionally open an urgent ticket with an unclear description of their problem, and forget to supply their site details. I occasionally wish I could just log into these sites in one click and see for myself, without needing to go back and forth for days on end. – Denis de Bernardy Jan 29 '11 at 14:18
  • 1
    @Denis - Ah, okay, yeah I see it now for the use-case of distributing plugins. Of course, if it were ever discovered by someone who was outraged about it, you'd have hell to pay in negative publicity. :) – MikeSchinkel Jan 29 '11 at 20:08
0

Ok, here we go. There are two things you need to do:

  1. Use a mu plugin (must-use plugin). Any PHP files in the wp-content/mu-plugins directory will automatically get loaded by WordPress before all other plugins. These must-use plugins cannot be deactivated. The only way to remove them is via FTP.

  2. Look into map_meta_cap() (view the source here). WordPress' capabilities system has something called 'meta capabilities'; for example there is no actual capability called 'edit_post', but when a user tries to edit a specific post, WordPress checks for that capability in the function current_user_can( 'edit_post', $post_id ). map_meta_cap() looks at that combination and checks things like whether the post belongs to this user; if not, are they allowed to edit any post they wish? if not, don't allow them to edit this post. So what you'd want to do is check the meta capabilities for things like edit_user and delete_user. If a user is trying to edit or delete your user and it's not you, don't let them.

Let me know if you have more questions. I don't really know how much you know about WordPress.

|improve this answer
  • Wow your quick thank you so much for all this help. Your first statement I am completely on the same page. and that is a great thing to know. your second statement i understand but i think your solving my problem but not the way i want. See I want to hide my user all together. so if its hidden than there will be nothing for them to delete(unless the get into the database). I hope this makes sense, let me know if it doesn't. Thanks again for your help. – Steve Fischer Jan 27 '11 at 22:52
  • I understand exactly what you're saying. Security through obscurity is no security at all. You may want to hide your user altogether, but without my solution, they can still delete your user by substituting the user id in the url to delete the user. – John P Bloch Jan 27 '11 at 23:22
  • OK. I now see your point. I already included step 2 in my code but now I understand why. Your right, I never about how the they could delete the user by altering the url. But I'm still looking for the advice on how the plugin won't display the particular user. – Steve Fischer Jan 27 '11 at 23:34
  • 1
    @user2774 - Why do you not want it to display the user vs. not allowing them to delete it? The former sounds very unethical to me. Does your client approve of this? – MikeSchinkel Jan 28 '11 at 2:24
  • The clients are aware I have access to anything and everything having to deal with their site. Honestly, a client has never asked "will you be able to get into my wordpress account?". I mean when you buy a car do you ask the car dealer "are these all the keys to this car or does Ford have a key to this car?" Fine I concede don't help me out. But SOMEONE please explain to me how having hidden super-admin can do any more damage than having all the hosting information??? ANYONE?? – Steve Fischer Jan 28 '11 at 13:36
0

Yes, this is possible and something I've created in several forms in the past for working with a few hundred sites run by my employer. I've even created a "Log in as User" feature where after verifying my rights, I could see exactly what the user was seeing. It was incredibly helpful for duplicating issues that occurred for one user and not another.

Your solution will have to be hand built by you, as few people will share this type of tool as low level tools like this the skill to create it is often considered a prerequisite for using it. You can obviously look into the login is processed now by WordPress to see where you need to add your code. In short, figure out how WordPress logins work and go from there.

I like others have an issue with you creating something your client doesn't know about and cannot remove. The fact that you are still named User2774 after two days and have no other questions to your name sure makes it look like you feel you need to hide this from your customers because they would not agree with the concept.

If you are legitimate and professional, you should do this in the open and inform your clients that it exists. You should proudly install the "User2774 Client Support Plugin" and as you are not hosting it on your own servers, allow them to deactivate it when you part ways. Gracefully allowing a client to chose a competitor is not a negative thing.

Besides, legitimate or not, installing hidden back doors in someone else's system opens you for liability when something does go wrong. Chances are you are not an LLC yet and would be personable liable if something bad happens & have to prove you and your back door had nothing to do with it.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.