Audit What Your WordPress Plugins Can Really Do

If you connected Rank Math to a free account and want to know whether it quietly handed itself admin-level powers, here is the short answer: check Users → All Users for accounts you did not create, run a capability audit on every active plugin, and watch your outbound traffic. You can do all three in about 20 minutes without touching a line of code.

The recent accusation against Rank Math — that connecting it to a free RankMath.com account granted it admin-style access — is worth taking seriously whether or not the details hold up. It's a reminder that a plugin runs with the full permissions of WordPress itself. Nothing technically stops one from creating users, changing roles, or opening a channel to a remote server. The fix isn't panic. It's a habit of checking.

This is a hands-on audit you can repeat every few months. No plugin gets a free pass, including the ones you trust.

What "admin access" actually means for a plugin

A WordPress plugin doesn't need a user account to act like an admin — it already runs as one. Any active plugin executes with whatever rights the logged-in user has, and on background tasks (cron, REST callbacks, webhooks) it can run unattended with full database access.

So when people say a plugin "granted itself admin," there are two distinct things to separate. One is a plugin creating an actual WordPress user account with the administrator role — visible in your users list. The other is a plugin holding a persistent connection to an external service that can push changes or read data back and forth. The first is easy to spot. The second is the one most people never look for.

The Rank Math case centred on the connection type: linking to a remote account and the scope of what that link allowed. That's why an audit has to cover both the users table and what your site talks to over the wire.

Step 1: Find hidden admin users

Go to Users → All Users and filter by the Administrator role — anything you don't personally recognise is a red flag. This is the fastest check and it catches the crudest form of privilege grab.

Look past the display name. A rogue account often uses a plausible-looking email on your own domain or a service address. Sort by registration date if your list is long; a fresh admin created around the time you installed or connected a plugin tells its own story.

For a deeper look, query the database directly. In phpMyAdmin (available in your TPC Hosting control panel) run:

• List every admin: SELECT u.ID, u.user_login, u.user_email, u.user_registered FROM wp_users u JOIN wp_usermeta m ON u.ID = m.user_id WHERE m.meta_key = 'wp_capabilities' AND m.meta_value LIKE '%administrator%';
• Swap wp_ for your real table prefix if you changed it.
• Cross-check every result against people you actually trust. Delete or demote the rest, and reassign their content when prompted.

If you use WP-CLI, wp user list --role=administrator gives you the same answer in one line.

Step 2: Audit what capabilities each plugin uses

The real risk isn't usually a fake user — it's a legitimate plugin quietly holding capabilities it shouldn't need, so map what each one touches. WordPress roles are built from granular capabilities (manage_options, edit_users, promote_users, install_plugins), and a plugin that requests edit_users when it only needs to save its own settings deserves a hard question.

You can't easily see this from the dashboard, so lean on a tool. Two that work well:

• User Role Editor or Members — lets you view and lock down exactly which capabilities each role holds, so a plugin can't silently promote someone.
• Query Monitor — install it, load a page, and open the panel. It shows which plugin fired which hooks, which HTTP requests went out, and how long each took. It's the single best free window into what your plugins are really doing on every request.

Practical rule: if a plugin's job is SEO, forms, or caching, it has no business creating users or editing roles. When Query Monitor shows a plugin hooking into user_register or calling add_role, find out why before you trust it further.

Step 3: See which plugins phone home

A plugin "phones home" when it opens an outbound HTTP request to its vendor — sometimes for licensing, sometimes for telemetry, sometimes to sync data you'd rather keep local. Some of this is harmless; some of it moves your data off your server without a clear reason.

Query Monitor's HTTP panel lists every outbound request per page load, with the calling plugin named. Watch for requests to third-party domains on ordinary page views (not just on the settings screen). Also check Tools → Site Health → Info → WordPress Constants and your scheduled events — wp cron event list in WP-CLI — because recurring calls hide in cron, not in page loads.

Under GDPR, outbound calls that carry personal data are your responsibility, not the plugin author's. If a plugin ships visitor or user data to a server outside the EU, you need to know and disclose it. This is one reason we keep TPC Hosting infrastructure inside the EU — it removes a whole layer of cross-border headaches — but your plugins can still leak data past that boundary if you don't watch them.

Step 4: Revoke, contain, and re-check

Once you've found something you don't like, the order of operations is: remove the access, then remove the plugin if it can't justify itself. Don't just deactivate and move on — deactivating a plugin rarely undoes the users or roles it created.

A tight cleanup checklist:

• Delete or demote any admin user you didn't create; reset passwords on the ones you keep.
• Revoke and regenerate any API keys or "connected account" tokens from the plugin's own settings and from the vendor's dashboard.
• Use Members or User Role Editor to strip edit_users, promote_users, and install_plugins from any role that shouldn't have them.
• Force a global logout so stolen sessions die: change the AUTH_KEY salts in wp-config.php.
• Rotate your application passwords under Users → Profile → Application Passwords — a common back door for REST-based access.
• Remove the plugin fully if it can't explain what it took.

Then re-run Step 1. If a demoted user pops back up to administrator after a page load, a plugin is re-granting it, and that plugin goes now. If you'd rather not do surgery on a live site, the real engineers on TPC Hosting support are on hand 24/7 and can help you check a suspicious install without guesswork.

Build the habit so it doesn't happen again

The best defence is a short routine, not a one-off panic after a headline. Keep your plugin count lean, review permissions when you connect anything to an external account, and treat "connect your free account" prompts as the moment to read what you're agreeing to.

A quick comparison of where to look and how often:

None of this requires you to distrust every developer. Most plugin authors are honest and most connections are benign. But the ones that aren't count on you never looking — so make looking cheap and routine, and the whole class of problem shrinks.

FAQ