A popular WordPress SEO plugin stands accused of silently granting itself administrator-level access to user sites. For UK service businesses relying on WordPress for local search visibility, this raises urgent questions about who controls your digital front door.
A widely-used WordPress SEO plugin has been accused of creating secret administrator access to user websites without consent or notification, raising serious security concerns for the millions of service businesses running WordPress sites.
The allegations centre on Rank Math, a popular SEO plugin used by plumbers, electricians, dentists and other service businesses to improve their local search rankings. According to claims made by the developer of a competing SEO plugin, Rank Math has introduced functionality that silently grants the company administrator-level permissions over WordPress sites when users access the plugin's Help & Support section.
The developer of The SEO Framework plugin reported on social media that when a user opens Rank Math's Help & Support section, the plugin creates a WordPress Application Password tied to that user's account. This happens automatically, with no explicit consent requested and no notification given to the site owner.
Application Passwords are a WordPress feature designed to allow external applications to access your site securely. They're meant to be created deliberately, with full knowledge of the site administrator. The accusation is that Rank Math is generating these credentials behind the scenes, potentially giving the company remote access to thousands of business websites.
For a local service business, your WordPress site is often your primary digital shopfront. It holds customer enquiries, booking systems, payment details, and the content that drives your local search visibility. Administrator access means complete control over all of it.
Most plumbers, electricians, dentists and fitness studios don't have in-house IT teams. You rely on plugins to handle SEO because you're busy running your business, not studying search algorithms. That trust is fundamental to how WordPress works.
If a plugin can grant itself admin access without telling you, several risks emerge immediately. First, there's the security exposure. Even if the plugin developer has no malicious intent, those credentials could be intercepted, leaked in a data breach, or exploited by a bad actor who gains access to the plugin company's systems.
Second, there's the control issue. Your website is your asset. You pay for the hosting, you own the domain, you create the content. A third party having silent administrator access fundamentally changes that relationship. They could, in theory, modify content, access customer data, or even lock you out of your own site.
Third, there's compliance. If you handle customer data under UK GDPR, you're responsible for who has access to it. Silent third-party admin access could put you in breach of data protection obligations you didn't even know you'd created.
If you use Rank Math and have connected it to a free Rank Math account, you should check your WordPress Application Passwords immediately. Navigate to Users, click on your profile, and scroll down to Application Passwords. Look for any entries you don't recognise or didn't create yourself.
The allegation is that the password is created when you open the Help & Support section within the Rank Math plugin. If you've never accessed that section, you may not be affected. But the lack of transparency means you can't be certain without checking.
This isn't about whether Rank Math is a good or bad SEO tool. It's about informed consent and control over your business assets. Even the best-intentioned feature becomes a problem when it operates in secret.
First, audit your WordPress site. Check which plugins have administrator access. Review your Application Passwords. If you find credentials you didn't create, revoke them immediately and investigate which plugin generated them.
Second, review your plugin choices. For SEO specifically, ask whether you need a complex plugin at all. Many service businesses would be better served by a simpler approach focused on local search fundamentals: accurate business information, genuine customer reviews, and regular content that answers the questions your customers actually ask.
That's where Rosie comes in. Rosie is The AIgency's Rankings & GEO Agent, designed to handle local search visibility for service businesses without requiring you to become a WordPress security expert. Rosie publishes content, manages your Google Business Profile, and keeps your business visible in local search and AI search results. No plugins to audit. No silent access. Just straightforward visibility work that you control.
Third, adopt a principle of least privilege. Only give admin access to people and tools that absolutely need it. Many plugins request more permissions than they require. If an SEO plugin needs to edit your content, that's reasonable. If it needs to create user accounts or modify core WordPress settings, ask why.
This allegation comes at a time when WordPress itself is navigating governance tensions. The platform's open-source nature is both its strength and its vulnerability. Millions of plugins exist, with varying levels of security review and oversight.
For service businesses, the lesson is broader than one plugin. Your website is critical infrastructure. Treat access to it with the same seriousness you'd treat access to your bank account or your customer database. Free tools often come with hidden costs, whether that's data collection, advertising, or in this case, potentially silent access.
The WordPress ecosystem has delivered enormous value to small businesses. It's democratised web publishing and made professional-looking sites accessible to everyone. But that accessibility shouldn't come at the cost of security or control.
As of the date of the original report, Rank Math had not publicly responded to the allegations. The company may have a legitimate explanation for the functionality, or they may modify it in response to the concerns raised. Either way, the incident highlights a gap in how plugin permissions are communicated to non-technical users.
For UK service businesses, the immediate action is clear: check your site, review your plugins, and make sure you know who has access to what. Your local search visibility matters, but not at the cost of losing control over your own digital assets.
If you're tired of navigating plugin security concerns and just want your business to show up when local customers search, Rosie handles that without the complexity. Get your free AI visibility report at The AIgency free report.
The AIgency home · Q&A · Blog