Instant alerts when a new administrator appears

Nearly every successful attack starts with one extra administrator account. If you know at that moment, you can shut the door before the damage spreads.

A "wp-sync" user created at three in the morning.

Whoever exploits a plugin vulnerability nearly always creates an administrator so they can get back in. The name looks believable and the account sits there for weeks.

Security plugins installed on the site are the first thing the attacker switches off.

The agent sees the change and the platform keeps it.

  1. Event on the site

    The agent sees new users, role changes and administrator logins.

  2. Sent at once

    The event goes straight to the platform, signed. If sending fails, we pick it up at the next sync.

  3. Alert

    A new administrator triggers a critical alert with username, email and time.

Want to try it on a real site? The 30-day trial needs no credit card.

Start free trial

Frequently asked questions

What if the attacker disables the plugin?

By then the event has already reached the platform. And if the site stops answering the agent, you get an alert after three attempts.

Do I get an alert when I create an administrator myself?

Yes, every new administrator is reported. If it was you, just close the alert.

Try it on your clients' sites.

Connect your first sites today and see what SitePing finds on them.

  • Every Complete feature except backups
  • Up to 10 sites
  • No credit card needed to start
  • At the end you choose a plan or move to Free, and nothing is charged
Start the 30-day trial

Already have an account? Log in. Prefer to look at one site first? Free read-only audit.