Rank Math Plugin Under Fire for Hidden Admin Access

What Happened: A Secret Backdoor in Rank Math

Rank Math, one of the most popular SEO plugins for WordPress, has been accused of silently creating an administrator-level Application Password when you open its Help & Support section. The allegation comes from the developer of The SEO Framework, a competing plugin, who tweeted about the behavior. No consent is requested, and no notification is given. This means if you're an admin and you click that support tab, Rank Math creates a password that could give the company access to your site.

This is a serious breach of trust. WordPress Application Passwords are meant for third-party integrations, not for silent backdoors. The fact that it's tied to the user who opens the section makes it even more concerning—it's not just a site-wide access, it's tied to an admin account.

Does This Affect Your Business?

If you run a WordPress site with Rank Math installed, this affects you directly. Even if you haven't opened the Help & Support section, the risk is real. Your site's security could be compromised, and you might not even know it. If you're an agency managing multiple client sites, the exposure multiplies.

But here's the thing: not every business uses Rank Math. If you're on another SEO plugin like Yoast or All in One SEO, you can breathe a little easier—but you should still be cautious about what plugins you trust.

What This Means for Your Business

For Rank Math users, this is a wake-up call. You need to check if an Application Password has been created and revoke it immediately. You also need to decide if you can trust a plugin that operates this way. Trust is the foundation of any tool you use, and this incident shakes that foundation.

For non-Rank Math users, this is a reminder to audit your plugins. Are there any that have hidden features? It's worth checking your WordPress dashboard for any unexpected Application Passwords or suspicious activity.

For the broader WordPress ecosystem, this could be a turning point. Plugin developers might think twice before implementing hidden access, and users might demand more transparency. This could lead to stricter guidelines or even platform-level enforcement.

Your Move: Immediate Action Steps

First, log into your WordPress admin and go to Users → Application Passwords. If you see any passwords you didn't create, revoke them. Second, consider whether Rank Math is worth the risk. If you're concerned, switch to a more transparent SEO plugin. Finally, stay informed—follow the news to see how Rank Math responds. If they don't address this properly, it's a red flag.

Don't wait. The longer you leave this, the more exposed your site is.

Source: Search Engine Journal