Removing the WordPress admin user

Why the default administrator account is worth deleting, and how to replace it safely.

Brute force attempts nearly always target the username admin, because it was the default administrator name in older WordPress versions. Removing it forces an attacker to guess the username as well as the password.

We do not create an admin user. You may still have one if you created it yourself, or if you brought the site over from somewhere that did.

Replacing the account

You cannot rename a WordPress user, so the way to remove admin is to create a replacement and delete the original.

1. Sign into WordPress as the admin user.
2. Go to Users, then Add New.
3. Give the new account a username that is not admin, and set its role to Administrator.
4. Set a long password. See choosing a strong password.
5. Click Add New User, then sign out.
6. Sign back in as the new account.
7. Delete the admin user. WordPress will ask what to do with its content, so choose to attribute it to your new account.

Attributing the content matters. Deleting the user without doing so removes the posts and pages they created.