The Admin Account Audit You Should Do Quarterly
Open the users list on your website right now and count the administrators. On sites we take over, the average is between four and nine, and the owner can usually identify three. The rest are former employees, past contractors, a plugin's service account, and one called "admin" that nobody created on purpose.
Why this is the highest-value security hour you can spend
Attackers do not need a clever exploit if a dormant account has a reused password from a breach three years ago. Old admin accounts are the most common entry point we see after outdated plugins, and unlike plugins, they are entirely within your control and free to fix.
The audit
- List every user with elevated rights, on the website, the host control panel, the registrar, DNS, analytics, and any connected service.
- Match each to a person and a reason. If you cannot do both, it goes.
- Downgrade rather than delete on the website, so authored content keeps its attribution. Reassign posts, then remove.
- Revoke API keys and application passwords tied to departed people or retired tools. These survive password changes and are frequently forgotten.
- Check for accounts you did not create. An unexpected administrator is an incident, not an oddity; treat it as a compromise until proven otherwise.
Tighten what remains
- Two-factor authentication on every administrator, without exception.
- Unique passwords from a manager, never reused from email or banking.
- The minimum role that lets each person do their job. Most people who "need admin" need editor.
- Remove or rename any generic account named admin, administrator, or the site name.
- Limit login attempts and, if practical, restrict the admin area by IP.
Make it recurring
Put it on the calendar quarterly, and add "remove website access" to your offboarding checklist so the list does not regrow. Ten minutes, four times a year, closes the door that most compromises walk through.
