Why does my admin email address keep changing to something random?

Every once in a while, I see an email like this:

Someone (hopefully you) has used this email to register at  My Website

Username: ********* 

Password: *********



Thanks
My Website

I login to my site, and sure enough, my admin email has changed to the one mentioned in the email. I freaked out the first time I saw it. I thought someone was trying to take over my site or put spam or ads on it or something.

However, since then, I've been using "WP Persistent Login", which tells me which devices are logged into my site, and every time my admin email has changed, I don't see any devices logged into my account, except my own.

These might be registered users on my site, but I'm not entirely sure. I have around 1200 legit registered users and around 800 that I think are spam accounts. I'm not really sure how to get rid of them and not sure if the changed admin email is from one of those that already existed or if they popped up just to change my admin email.

Could this be happening by accident? What precautions should I take?

Edit:

I forgot to mention, these emails are not going to my account, they are being sent from my G Suite account, which is what my website sends from.

Topic admin spam security Wordpress

Category Web

1
answered at

if your admin email changes, I suppose it's not a good signal, so it's very important understand why it's happening.

Some malware usually have this behaviours, so I think you can start from:

  • have you checked if your plugins, theme and WP core are updated to latest versions? if no - backup all and proceed with the updates;
  • try to check if some of the spam users you mentioned have an adminsitrative role.

Let us know, cheers.

About

Geeks Mental is a community that publishes articles and tutorials about Web, Android, Data Science, new techniques and Linux security.