Why this matters
Good site governance might sound a bit dull, but it plays an important part in client site security. Administrator user accounts should only be provided to people who require that level of access, and this should be a very short list (you, and an emergency use only account for your client).
I’ve seen many freelancers comment about clients creating an admin account for a new “SEO agency” who then installed different plugins, broke the site, or eventually hijacked the client and migrated them away without prior notice (deleting your admin user in the process, but not changing the administration email address).
Keeping a close eye on admin user account creation can help you avoid these potential headaches in the future. With a few simple measures in place you can help protect yourself from this situation, while also adding a security speed bump.
What it does
There are two steps to secure a site’s admin user creation via the UI. The first one is automatic, so you don’t need to make any changes to benefit from it.
A new confirmation check box is displayed when the role is changed to administrator. This should make the person creating the user briefly pause to ask themselves the question “does this user really need to be an administrator?”.
This simple “are you human” check also provides an additional security speed bump. If another admin, plugin, or basic XSS attack, attempts to create a user it would fail with an on screen message. It will also send an email alert to the administration email address (you).
This alert lets you know the user account who attempted the user creation, as well as the email address of the potential new admin user. Do you recognise the email address, or is it the first sign of that dreaded rogue SEO agency?
Its highly likely to be you on auto pilot, forgetting to tick the box, but its better safe than sorry.
The second step is to act like a bouncer at a fancy night club. If the user’s domain name isn’t on the allowed domains list the user creation will be blocked.
How to set it up
The quickest way to set your allowed domains list is from the ToggleWP > Security & Auth tab, found via the main menu (after enabling the Security & Authentication option on the Manage screen). Clicking the “Auto-populate from existing admins” button will check the domain name of all current administrator users and add them to the list.
If there is a domain name you don’t recognise you can remove it before clicking save. Remember to delete / down-grade the user with the matching domain name.