Title: Ethwebs Role Auditor Author: Sanmatiraj Published: August 24, 2026 Last modified: August 24, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/ethwebs-role-auditor.svg) # Ethwebs Role Auditor By [Sanmatiraj](https://profiles.wordpress.org/sanmathiraj/) [Download](https://downloads.wordpress.org/plugin/ethwebs-role-auditor.1.0.1.zip) * [Details](https://wordpress.org/plugins/ethwebs-role-auditor/#description) * [Reviews](https://wordpress.org/plugins/ethwebs-role-auditor/#reviews) * [Installation](https://wordpress.org/plugins/ethwebs-role-auditor/#installation) * [Development](https://wordpress.org/plugins/ethwebs-role-auditor/#developers) [Support](https://wordpress.org/support/plugin/ethwebs-role-auditor/) ## Description **Ethwebs Role Auditor** is an ultra-lightweight, zero-bloat security tool specifically built to catch privilege escalation and unauthorized administrator account creations— even when performed via direct database SQL injection attacks that bypass standard security plugins. Most security logging plugins create heavy custom database tables and rely strictly on standard WordPress hooks (`wp_login`, `user_register`). When attackers exploit database vulnerabilities, they insert rows directly into `wp_users` and `wp_usermeta`, bypassing WordPress hooks entirely. Ethwebs Role Auditor addresses this by running direct, prefix-aware SQL database queries during scheduled background audits to count and identify every single user account holding administrator capabilities. ### Key Features: * **Direct Database SQL Audit:** Queries the database directly to detect unauthorized administrator accounts added via SQL injection. * **Instant Dashboard Status:** Displays real-time role counts and active admin IDs immediately upon opening the settings page. * **Smart Subject Line Previews:** View current admin and editor counts directly in your email inbox subject line without having to open the message. * **Multiple Recipient Notifications:** Enter single or comma-separated email addresses to notify your security team. * **Attacker Exclusion Protection:** Intelligently strips newly promoted/attacker email addresses from receiving security alerts. * **Manual “Run Check Now” Audit:** Trigger an instant on-demand database scan and email test directly from your settings panel. * **Instant Role Elevation Alerts:** Receive email notifications whenever a user is created or promoted to Administrator or Editor. * **New Admin Login IP Detection:** Lightweight persistent IP tracking notifies you when an administrator accesses the dashboard from an unrecognized IP address. * **Zero Database Bloat:** Creates zero custom database tables and runs cleanly in the background. ## Screenshots [⌊Current Role Status: Live database audit table showing user counts per role and detected active admin user IDs.⌉⌊Current Role Status: Live database audit table showing user counts per role and detected active admin user IDs.⌉[ Current Role Status: Live database audit table showing user counts per role and detected active admin user IDs. [⌊Manual Audit & Email Trigger: Instant on-demand audit trigger button and email dispatch status notice.⌉⌊Manual Audit & Email Trigger: Instant on-demand audit trigger button and email dispatch status notice.⌉[ Manual Audit & Email Trigger: Instant on-demand audit trigger button and email dispatch status notice. [⌊Configuration Settings: Notification email recipients, maximum expected admins baseline, and alert option checkboxes.⌉⌊Configuration Settings: Notification email recipients, maximum expected admins baseline, and alert option checkboxes.⌉[ Configuration Settings: Notification email recipients, maximum expected admins baseline, and alert option checkboxes. [⌊Setup Email Report: Sample security audit report email received with live user role summary and subject line count preview.⌉⌊Setup Email Report: Sample security audit report email received with live user role summary and subject line count preview .⌉[ Setup Email Report: Sample security audit report email received with live user role summary and subject line count preview. [⌊Admin IP Access Alert: Security email intimation received when an administrator accesses the dashboard from a new IP address.⌉⌊Admin IP Access Alert: Security email intimation received when an administrator accesses the dashboard from a new IP address .⌉[ Admin IP Access Alert: Security email intimation received when an administrator accesses the dashboard from a new IP address. ## Installation 1. Upload the `ethwebs-role-auditor` folder to the `/wp-content/plugins/` directory. 2. Activate the plugin through the **Plugins** menu in WordPress. 3. Navigate to **Settings > Ethwebs Role Auditor** to configure recipient emails and alert preferences. 4. Click **Run Check Now & Send Email** to send an instant email report copy. ## FAQ ### Do I need an SMTP plugin configured for this plugin to work? No. While email reports are sent out in the background, the settings page inside the WordPress dashboard always displays the full, real-time audit table (including user role counts and active admin user IDs) directly on screen. ### How does this plugin detect attacks that bypass standard security plugins? Most security plugins rely strictly on standard WordPress action hooks (like `wp_login`). When attackers use SQL injection vulnerabilities, they write administrative users directly into database tables (`wp_users` and `wp_usermeta`), completely bypassing the WordPress hook layer. Ethwebs Role Auditor executes a direct SQL database query against your actual database table prefix to count and identify every single user account holding `administrator` capabilities, catching silent database modifications instantly. ### What happens if an attacker creates an admin account with their own email address? Ethwebs Role Auditor features an Attacker Exclusion Safeguard. When an instant role elevation alert fires, the plugin checks the promoted user’s email address against your notification list and strips out the attacker’s email, ensuring they never receive security warnings about their own activity. ### Can I send alerts to multiple team members? Yes. You can enter multiple comma-separated email addresses (e.g. `admin@site.com, security@site.com`) in the Notification Email field under **Settings > Ethwebs Role Auditor**. ### Will this plugin slow down my site or bloat my database? No. Unlike standard activity log plugins that write thousands of rows to your database every time a page is loaded, Ethwebs Role Auditor is zero-bloat. It creates zero custom database tables. Cron checks run lightly in the background once per day, and temporary session IP tracking uses standard auto-expiring WordPress transients. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Ethwebs Role Auditor” is open source software. The following people have contributed to this plugin. Contributors * [ Sanmatiraj ](https://profiles.wordpress.org/sanmathiraj/) [Translate “Ethwebs Role Auditor” into your language.](https://translate.wordpress.org/projects/wp-plugins/ethwebs-role-auditor) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/ethwebs-role-auditor/), check out the [SVN repository](https://plugins.svn.wordpress.org/ethwebs-role-auditor/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/ethwebs-role-auditor/) by [RSS](https://plugins.trac.wordpress.org/log/ethwebs-role-auditor/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.1 * Added dynamic email subject lines showing live admin and editor counts directly in inbox previews. * Enhanced settings page to display live database role counts and active admin IDs immediately on page load. * Upgraded IP tracking to persistent user meta whitelisting to catch backdoor dashboard access without email spam on clicks. * Added detailed UI and email sample screenshots to directory listing. #### 1.0.0 * Initial release. Features direct database auditing, on-screen dashboard report displays, comma-separated multiple email recipients, attacker exclusion safeguard, manual audit check trigger, and IP tracking. ## Meta * Version **1.0.1** * Last updated **11 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [admin](https://wordpress.org/plugins/tags/admin/)[audit](https://wordpress.org/plugins/tags/audit/) [database](https://wordpress.org/plugins/tags/database/)[roles](https://wordpress.org/plugins/tags/roles/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/ethwebs-role-auditor/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/ethwebs-role-auditor/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/ethwebs-role-auditor/reviews/) ## Contributors * [ Sanmatiraj ](https://profiles.wordpress.org/sanmathiraj/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/ethwebs-role-auditor/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://wayanad.co.in/wordpress-plugins/)