ITX UserOps — User Management, Login Activity, Sessions & Audit Log
WordPress has no unified user administration console. To see who is online, keep a login audit trail, force-logout a compromised account, disable a departed contractor without deleting their content, find out whether the password reset actually went out, or edit a role without deciphering sixty capa
WordPress has no unified user administration console. To see who is online, keep a login audit trail, force-logout a compromised account, disable a departed contractor without deleting their content, find out whether the password reset actually went out, or edit a role without deciphering sixty capability checkboxes, you normally need five or six single-purpose plugins. And none of them tells you when someone has got in and hidden their tracks from the admin screens.
ITX UserOps replaces that whole stack with one fast, cohesive console — the kind of user administration Microsoft 365 or Google Workspace admins get out of the box — and watches the site itself for the signs a break-in leaves behind.
Website | Documentation | All features | Changelog | Support
Signs of a break-in, even one that hides from wp-admin
Written from a real case: a site was held for weeks by attackers whose plugins hid themselves from the Plugins screen, whose administrators were hidden from the Users screen, and whose script was printed in front of every page. Each of those is now checked for, on the site itself:
- An administrator who exists in the database but is hidden from the Users screen, or one created by code running on the server with nobody signed in — the file that did it is named
- A plugin hidden from the Plugins screen, one running while the Plugins screen calls it inactive, and a plugin, must-use plugin or drop-in that appeared without being installed through WordPress
- Code printed in front of your pages or REST responses. The plugin’s own screens read past it and keep working, and show what was added
- An administrator signed in without the login form — a login cookie issued with no sign-in, so no password, two-factor or lockout was ever checked
- A file inside wp-content that starts WordPress by itself when its address is requested — how backdoor endpoints run. The first week is spent learning what is normal on your site
- Each finding says what happened and what to do. It is logged as Critical , emailed to the site’s admin address, sent to connected phones, and shown at the top of the WordPress Dashboard until it is dealt with
- Management tools that hide on purpose (MainWP Child, ManageWP Worker, InfiniteWP, iThemes Sync) are left alone, and changing your own password or using View as is recognised
