And how to shut the door attackers keep walking through.
It usually starts the same way. You log into your WordPress dashboard on an ordinary morning, glance at Users, and there are three accounts you have never seen. Odd names. Gmail addresses with strings of numbers. Registered at 3 a.m.
You delete them. You install a login-limiting plugin. Four more appeared two days later.
You should read this post if that seems similar. We want to explain what is actually happening, why the usual advice doesn’t stop it, and what does.
The mistake almost everyone makes
When people think about WordPress being hacked, they picture someone guessing a password. So they install a plugin that limits login attempts, add two-factor authentication, and consider the job done.
That protects the front door. The problem is that creating a WordPress user does not require walking through the front door at all.
WordPress has a function called wp_insert_user(). Every part of the system that makes an account calls it: the registration form, the REST API, XML-RPC, WooCommerce checkout, and — crucially — every plugin on your site. When a plugin has a vulnerability, an attacker doesn’t guess your password. They send a request that makes the vulnerable plugin call wp_insert_user() on their behalf.
Your login-limiting plugin never sees it, because nobody attempted a login.
This is why the accounts keep coming back. You are locking the door while someone climbs in through a window you didn’t know existed.
What attackers actually do, in order
Here is the sequence that plays out on ordinary small business sites every day. None of it is sophisticated. All of it is automated.
- They find out who you are. Before attacking, bots harvest usernames. A default WordPress install leaks them freely: visit yoursite.com/?author=1 and WordPress helpfully redirects to /author/yourusername/. The REST API endpoint /wp-json/wp/v2/users lists every author. Your XML sitemap may include an author section. Now they have a real username instead of guessing “admin”.
- They try passwords — but not the way you think. Rather than thousands of attempts against one account, which trips any lockout, they try three or four very common passwords against many sites. It is slow, quiet, and it works often enough.
- They probe your plugins. This is the big one. Bots scan for known vulnerable versions of popular plugins. When they find one, they use its own code against you — often to create an administrator account directly, without ever touching your login page.
- They escalate quietly. A smarter attacker doesn’t create an obvious new admin. They take an existing dormant subscriber account and quietly add the manage_options capability to it. Look at your user list and you see a subscriber. Look at what it can actually do, and it owns your site. This is the attack that survives cleanups, because nobody thinks to check.
- They drop a backdoor. A single PHP file uploaded into wp-content/uploads/ gives permanent access. Your media library shows an image; the server sees an executable script. Even if you remove their account, they come back through the file.
- They wait. Most compromised sites are not defaced. They are quietly used to send spam, host phishing pages, or inject links into your content for SEO. You often find out when Google flags your domain, or when your host suspends your account.
What actually stops this
You can do most of this yourself, today, with no plugin at all. It is worth understanding regardless of what tools you use.
Close registration properly. Settings → General → uncheck “Anyone can register”. Then check it again in a month — a compromised site frequently has this quietly switched back on.
Restrict user creation, not just logins. This is the missing piece. If nothing on your site can create an account except a logged-in administrator, the entire class of vulnerable-plugin attacks stops producing results. The attacker’s request still arrives; it just doesn’t get a user out of it.
Watch capabilities, not roles. A subscriber with manage_options is an administrator wearing a disguise. You need something checking what accounts can actually do, not what they are labelled.
Stop PHP running in your uploads folder. Nothing in /uploads/ should ever execute. A few lines in .htaccess neutralise every backdoor dropped there, before you even know it exists. This one change defeats a huge share of real compromises.
Close the enumeration leaks. Block?author=N, disable author archives, remove the REST users endpoint, and keep usernames out of your sitemap. Attackers who cannot learn your username have to guess two things instead of one.
Turn off XML-RPC. Almost no modern site needs it. Note that WordPress’s own setting only disables authenticated methods — the endpoint still answers. It needs blocking outright.
Rotate your salts after any incident. Changing passwords does not log out an attacker who already holds a valid session cookie. Changing the salts in wp-config.php does. This step is skipped constantly, and it is why sites get “re-hacked” days after a cleanup.
The plugin we built
We ran into this problem on a site we manage. Login limiting was in place, a CAPTCHA was in place, and accounts still appeared. So we wrote a plugin to close the actual gap, and we have been refining it since.
AAA Bytelabz Security is a single PHP file that:
- Blocks user creation at the lowest level in WordPress. It hooks wp_insert_user() itself, so REST, XML-RPC, AJAX, WooCommerce and any plugin are all covered by one rule: only a logged-in administrator creates users.
- Blocks privilege escalation. Any attempt to grant administrator-level capabilities to an account that shouldn’t have them is refused and reported — including edits to the role definitions themselves.
- Locks down the REST API to an allowlist, while leaving WooCommerce’s cart and checkout working normally.
- Hardens the uploads folder and refuses executable uploads, including the photo.php.jpg double-extension trick.
- Blocks username enumeration and XML-RPC completely.
- Emails you once a day, and only on a day when something real happened. Genuine emergencies arrive immediately; a thousand blocked bot requests arrive as one line in tomorrow’s summary. Or set it to send nothing at all and read the log when you feel like it.
It works on shared hosting. It needs no server access, no shell, and no subscription.
What it does not do
We would rather tell you this now than have you discover it later. No plugin makes a WordPress site unhackable. If an attacker already has a backdoor writing directly to your database, hooks cannot stop it — our plugin will report a new administrator appearing, but it cannot prevent it. It scans WordPress core and your uploads folder, not every plugin and theme file. And nothing at the WordPress layer helps if your hosting account or database credentials are compromised.
If you are already hacked, software is the second step. The first is finding how they got in.
Get it the way that actually works
We could hand you a zip file and a setup guide and wish you luck. We’re not going to.
Every WordPress site we’ve looked at has its own mix of plugins, hosting quirks, and half-finished changes from three admins ago. A plugin dropped in blind can miss exactly the thing that matters on your site — and “close registration, but not for the booking form that needs it” isn’t a setting you want to guess at.
So we don’t offer AAA Bytelabz Security as a self-serve download. We install it, configure it for your setup — WooCommerce, membership sites, multisite, whatever you’re running — and walk through the hardening checklist with you, so you know what changed and why.
If you’ve read this far, you already know more about how your site could be attacked than most WordPress users ever will. That’s exactly the moment to talk to us, not later, after the three accounts show up again.
Reach out and tell us your site URL and what you’ve noticed — a stray admin account, a host warning, or just “I don’t want this to happen to me.” We’ll tell you plainly whether it’s a quick fix or something that needs a closer look.
📧 [your email] · 🌐 [your website] · 📞 [your phone]
Send us your site URL and what you’ve noticed. If it turns out to be something you can fix yourself in ten minutes, we will tell you that.
