Why the default admin username is worth reviewing and how to replace it without breaking ownership.
Why this check matters
A predictable administrator login gives attackers one less thing to guess. The username is not the whole security story, but removing a common default reduces avoidable exposure.
How to review it
- List administrator accounts and confirm who owns each one.
- Create a named administrator account with a strong unique password.
- Transfer authorship of existing content where required.
- Remove the unused default account only after the transfer is verified.
Keep the change safe
Keep at least one tested administrator account and record recovery contacts before deleting any user.
How WPVitals uses this signal
WPVitals checks this setting locally and reports the result in the WordPress dashboard. The check is a maintenance signal, so review the site context before changing a setting and test the visitor experience afterwards.