My magento site was recently hacked, and I'm trying to clear out admin users from the database. I'm wondering if it's safe to delete all of the admin users that I don't recognize, or if some modules/extensions may depend on them.

  • Are there modules that create admin users?
  • Is there a way for me to tell which users are legitimate, and which ones aren't?
  • you can create new admin user via code – Abdul Nov 10 '15 at 12:48
  • Yes, but I want to remove admin accounts that shouldn't be there, I'm trying to determine which ones these are. – Steven Jeffries Nov 10 '15 at 12:50
  • have you created additional roles for the any admin users? – Abdul Nov 10 '15 at 12:53
  • 1
    There should not be extensions that create admin users. If they are, stay away from them. Delete everything you don't recognize. I would use the admin grid to do it, instead of deleting the records directly form the db. – Marius Nov 10 '15 at 12:54
  • yes, remove all roles and admin users safely. you can always add what you need back. – MagenX Nov 10 '15 at 18:40

You should perform the following steps:

  1. Backup your database
  2. Log in with a known admin account
  3. Create a new admin account to use exclusively from this point on
  4. Delete all accounts with the exception of the one created in step 3.
  5. Delete any additional roles that were created
  6. If you had roles configured for a specific purpose, re-create them
  7. If you had users configured for a specific purpose, re-create them

Modules shouldn't be creating an admin accounts.

The only valid reason would be a specific need that you would have created them for. As the admin of your site, if you don't recognize something then delete it.

If you aren't comfortable deleting, then at the very least you should disable any accounts that you don't recognize, if they are legitimate the people you created them for will contact you saying they can't login.

  • I feel a lot better about deleting all of these bogus accounts now. – Steven Jeffries Nov 10 '15 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.