Audit and remove unused admin accounts and plugins

Auditing and removing unused admin accounts and plugins addresses a genuine security principle worth understanding clearly — every active administrative account and every installed plugin or extension represents potential attack surface, regardless of whether it's actively being used, meaning unused elements provide risk with no corresponding legitimate benefit.

Unused admin accounts represent a particularly common, often-overlooked risk — former employees, contractors, or team members who no longer need administrative access but whose accounts were never properly deactivated represent genuine, unnecessary risk, since these accounts remain valid access points that could be compromised or misused without providing any current legitimate business value.

Unused plugins or extensions carry similar risk from a different angle — even inactive plugins can sometimes retain exploitable vulnerabilities, and simply having unnecessary code installed on your system, even if not actively invoked, represents unnecessary attack surface that a genuinely minimal, well-maintained system would eliminate entirely rather than leaving present but dormant.

This audit deserves periodic repetition rather than treatment as a single, one-time cleanup — team composition changes, and plugin needs evolve over time, meaning new unused accounts or extensions can accumulate after any initial cleanup, making this a genuine, recurring maintenance practice worth building into your regular security review process.