Count the people who can log into your website
The most common problem on an inherited website is not the theme or the plugins. It is the list of administrator accounts nobody has looked at since launch.
Open the users screen on your website. Count the accounts with administrator rights. Now work out which of them belongs to somebody who still works with you.
On a site that has been through a couple of agencies, a freelancer and a staff change, that second number is almost always smaller than the first. It is the single most common finding on an inherited website and it is also the easiest thing on this list to fix today.
What tends to be there
- A developer account from the agency that built the site three years ago.
- A shared login that several people use, so no change can be attributed to anyone.
- A plugin or app account with far more access than its function requires.
- The original admin account, still on the default username, still reachable at the default login path.
- An account belonging to somebody who left, with a password that was never rotated.
Why it matters more than it sounds
An administrator on a content platform can install code. That is the whole of it. Installing a plugin, editing a theme file or adding a snippet is a normal administrative action and also a way to run arbitrary code on your site. So every unnecessary administrator is a route to full compromise held by somebody who is not accountable for it and may not know they still have it.
What to do this week
- Remove accounts belonging to people who have left. Reassign their content rather than deleting it with them.
- Give each remaining person their own named account, at the lowest role that lets them do their job. An editor who writes posts does not need to install plugins.
- Turn off shared logins. A shared account destroys the one thing you want after an incident, which is the ability to answer who did this.
- Turn on two-factor authentication for anyone with administrative rights.
- Rate limit the login form and stop advertising the default administrative path.
- Put a review in the calendar. Twice a year is enough to stop the list drifting again.
None of this needs a project. It needs an hour and somebody willing to be slightly unpopular about who really needs administrator access.
Founder & Lead Penetration Tester at Nextralix. Manual web and API penetration testing with a focus on authentication, authorization, account lifecycles and business logic.