iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Review WordPress access in four places: Users for human accounts and roles, each profile’s Application Passwords for API credentials, Plugins > Installed Plugins for standard extensions, and the server’s wp-content/mu-plugins directory for must-use plugins. Reduce every person to the least-powerful role that supports their current work, revoke credentials that no longer have an owner, and remove an account only after deciding what happens to its posts and links.
The exact controls vary with single-site versus multisite WordPress, custom roles, hosting restrictions, and installed plugins. Use a second trusted administrator or network Super Admin as a recovery contact, record each change, and test affected publishing, scheduled, and API workflows afterward.
What you are reviewing—and why role names are not enough
A WordPress role is a bundle of capabilities. On a single site, Administrator has broad control over that site. In a multisite network, Super Admin controls network functions and carries all possible capabilities across the network. Those labels are useful starting points, not a complete access audit: plugins and custom code can add, remove, or alter capabilities, and a custom role may not behave like a similarly named core role.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThe access review therefore has two layers:
- Human identity: who can sign in, which site they can reach, and which role or capabilities they have.
- Machine identity: application passwords, plugin tokens, API keys, OAuth grants, scheduled jobs, and other credentials used without an interactive login.
WordPress documentation summarizes the governing principle as: “Only grant the capabilities required for the tasks the role is intended to perform.” Apply that principle to both layers, while preserving content ownership and keeping live integrations running.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Prepare a safe review
Define the installation and recovery path
Record whether the site is single-site or multisite. On multisite, identify a second trusted Super Admin who can recover access if a role change is too restrictive. On a single site, confirm that another administrator can sign in before changing or removing the account you are reviewing. Do not rely on a shared emergency login; identify a named person who is responsible for recovery.
Keep a change log
For every account or credential, record the login or credential name, current access, responsible person or service, reason for the decision, action taken, date, and verification result. This makes an unexpected failure traceable and gives the next administrator enough context to avoid restoring obsolete access.
Plan the content decision before deleting a user
WordPress asks what to do with a deleted user’s posts and links. Decide in advance whether those items should be deleted or attributed to another account. If the person is a former contractor or agency user, ask the content owner—not merely the technical administrator—to approve the ownership outcome.
Inventory accounts in the Users screen
Inspect every account
- Sign in to wp-admin.
- Open Users (or Network Admin > Users when reviewing network users).
- For each account, note the username, email address, role, and post count.
- Confirm with the person or service owner whether access is still required and what tasks it supports.
Pay particular attention to former employees and contractors, generic shared logins, old agency accounts, dormant users, and accounts whose role is broader than their current duties. These are review priorities, not WordPress labels that automatically indicate an unsafe account. A dormant account may still own important content or power an integration, so verify before acting.
Review multisite separately
In multisite, inspect both network-level users and each site’s assigned role. A person can have a limited role on one site and Super Admin authority across the network. Review Super Admin membership first because it affects network administration, then examine site-specific assignments. Removing a site role does not necessarily remove network access.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Match each person to the least-powerful role
Choose the role that supports the person’s actual duties, not the role they originally received. Core roles provide a useful baseline:
| Role | Typical capability boundary | Good review question |
|---|---|---|
| Administrator (single site) | Broad access to the site’s administration features. | Does this person still need site-wide configuration, user, plugin, and theme control? |
| Editor | Can manage and publish posts, including posts written by other users. | Do they coordinate or publish other authors’ work? |
| Author | Works with their own posts. | Can their publishing be limited to content they create? |
| Contributor | Can draft content but cannot publish it. | Should an editor approve every publication? |
| Subscriber | Primarily manages their own profile. | Do they need a login only for profile or member-facing functions? |
Do not infer effective access from the role label alone. A plugin may create a role, grant an Editor an additional capability, expose an administrative endpoint, or authenticate an API request independently. If the site uses custom access-control code, review its role and capability definitions alongside the Users screen.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDowngrade or delete an account safely
Downgrade when the person still needs access
- Confirm another trusted administrator can sign in.
- Open Users, select the account, and use the role control to choose the least-powerful appropriate role.
- Save the change.
- Ask the user to test the tasks they still own, such as drafting, editing, or publishing.
- Record the previous role, new role, reason, and test result.
A downgrade preserves the login and authorship while reducing administrative reach. If the user reports a missing function, identify the specific capability needed rather than restoring Administrator by default.
Delete when access is no longer required
- Confirm the account has no remaining human or service owner.
- Check its posts and links and agree whether to delete them or reassign them.
- In Users, choose Delete for the account.
- When prompted, select the approved content-ownership option and complete deletion.
- Verify that expected pages, links, feeds, and workflows still work.
The currently logged-in user cannot delete their own account from that screen. If you are the only administrator, create and verify a separate named administrator before attempting to remove the old one. Deleting a user also does not automatically revoke credentials stored by a plugin or an external service; those must be checked separately.
Review and revoke Application Passwords
Understand what an Application Password is
An Application Password is an individual credential for programmatic API authentication. It is not the user’s normal interactive wp-admin password. WordPress lets you revoke one credential without changing the account’s main password, which makes per-integration cleanup possible.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Review credentials from the profile
- Open Users and select the relevant user.
- Scroll to the Application Passwords section.
- Review each descriptive name and available usage information, such as last-used time or IP address.
- Ask the integration owner to identify unfamiliar entries before revoking them.
- Revoke credentials that are unused, ownerless, duplicated, or tied to a retired service.
Use one credential per integration where possible. A name such as “mobile publishing,” “backup service,” or “staging deployment” is more useful than a generic label because it gives the next reviewer a clear owner and purpose. WordPress guidance is explicit: “Revoke any credential that is no longer needed.”
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use WP-CLI when SSH access is part of the workflow
On a site managed through SSH, list and remove credentials with WP-CLI. First confirm the account’s numeric user ID:
wp user get USERNAME --field=IDList that user’s application passwords:
wp user application-password list USER_IDDelete the selected credential by its UUID only after matching the UUID and description to your change log:
wp user application-password delete USER_ID UUIDSubstitute the actual username, user ID, and UUID; do not delete by guesswork. Application-password availability can be disabled or filtered by site configuration, so an absent section does not prove that no other integration credentials exist.
Know the boundary of this inventory
The profile list covers WordPress Application Passwords, not every secret a plugin or external service may store. It will not necessarily show a plugin’s API key, an OAuth grant held by a third party, a hosting credential, a webhook secret, or a token saved in a custom settings table. Open each connected plugin’s integration or credential screen and follow that service’s revocation procedure. If a former user owned an integration, transfer ownership or rotate its credential before deleting the account.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Audit installed plugins and permissions
Review standard plugins in wp-admin
- Open Plugins > Installed Plugins.
- Record active and inactive plugins, their versions, and the feature or service owner.
- For an unneeded standard plugin, select Deactivate first.
- Test the site, then select Delete if the plugin is confirmed unnecessary.
Deactivation stops a standard plugin without removing its files. Deletion removes the plugin through WordPress’s normal control and may also remove plugin data depending on that plugin’s design. Before either action, check dependencies and user-facing behavior. Forms, commerce, backups, security controls, SEO features, membership functions, and content blocks can fail in ways that are not obvious on the home page.
Inspect must-use plugins separately
Must-use plugins are automatically enabled, do not appear in the default Plugins list, and cannot be disabled from that screen. Check the server directory wp-content/mu-plugins and the deployment process that populates it. File-level removal or a host/developer change may be required. Do not delete a must-use file merely because it is absent from wp-admin; identify its purpose and confirm the deployment owner first.
Look for capability and authentication changes
For every plugin that affects users, APIs, automation, or administration, read its settings and documentation for:
- Custom roles or capabilities granted to existing roles.
- REST, XML-RPC, webhook, or other API endpoints.
- Service accounts, tokens, OAuth connections, and scheduled jobs.
- Separate administrator screens or login paths.
- Data-retention or uninstall options that affect content and credentials.
A clean Installed Plugins list does not establish the full access model. A plugin may have been removed while its role or configuration remains, or a must-use component may still be active outside the normal list.
Compare the decisions that are easy to confuse
| Decision | What it changes | What it does not prove |
|---|---|---|
| Single-site Administrator vs multisite Super Admin | Site-wide administration versus network-level control. | That the person needs either level for current duties. |
| Role change | Changes the user’s assigned bundle of capabilities. | That plugins or custom code have not added extra capabilities. |
| Application-password revocation | Stops one programmatic credential. | That other plugin tokens, OAuth grants, or hosting secrets are gone. |
| Plugin deactivation | Stops a standard plugin while leaving it installed. | That its code, data, or related must-use components have been removed. |
| Plugin deletion | Removes a standard plugin through the Plugins screen. | That dependent features or credentials are no longer needed. |
| User deletion | Removes the login after a content-ownership choice. | That posts, links, integrations, or external accounts have been safely transferred. |
Verify changes and recover from mistakes
Test with the correct identity
After changing a role, use an appropriately scoped test account or ask the service owner to perform the real task. Check drafting, editing, publishing, media uploads, user management, plugin settings, and any custom workflow relevant to the changed capability. Do not test only with your own Administrator account; it can hide a permission failure.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Watch asynchronous and external workflows
For at least the next expected run, monitor scheduled jobs, API calls, backup reports, publishing queues, webhooks, and integration logs. A revoked Application Password may not fail until the next scheduled request. A deleted user may be referenced by an automation or an ownership rule even when normal page navigation appears correct.
Restore the smallest necessary access
If a workflow fails, use the change log to identify the exact action. Restore the prior role or credential only long enough to diagnose the dependency, then replace it with a narrower capability or a newly issued, owner-labeled credential. Avoid reverting every change at once, because that obscures the cause and leaves unnecessary access in place.
Make access review ongoing maintenance
WordPress security guidance treats access and software maintenance as continuing work. Keep WordPress core, plugins, and themes updated; choose extensions that are actively maintained; and maintain a tested recovery path. Updates can change capability behavior or menu labels, so recheck critical roles and integrations after major changes.
Recommended Free Tools
Set a review cadence appropriate to the site’s staffing and risk, rather than assuming a universal interval. Revisit access after employee departures, contractor or agency changes, ownership transfers, plugin replacements, and hosting migrations. At each review, repeat the same sequence: inventory identities, match capabilities to duties, revoke unneeded credentials, inspect standard and must-use plugins, test affected workflows, and update the change log.
Quick Recap
A practical review checklist
- Installation type recorded: single-site or multisite.
- Second trusted administrator or Super Admin verified.
- Every user’s login, email, role, and post count reviewed.
- Former, shared, dormant, and oversized accounts assigned an owner or decision.
- Custom roles, capability changes, and access-control code identified.
- Role downgrades tested with the user’s real tasks.
- Content ownership decided before any user deletion.
- Application Passwords matched to named integrations and owners.
- Unneeded Application Passwords revoked individually.
- Plugin-specific tokens, OAuth grants, API keys, and hosting secrets checked outside the profile screen.
- Active and inactive standard plugins inventoried.
- Unneeded standard plugins deactivated, tested, then deleted.
wp-content/mu-pluginsand deployment controls inspected.- Scheduled jobs, APIs, publishing, and customer-facing workflows verified.
- Core, plugins, and themes kept current and recovery procedures maintained.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
