What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review WordPress access in two layers: first identify every human account with elevated capabilities, then inspect the application credentials and plugin-specific permissions that can continue working after a role change. On a single site, an Administrator can manage nearly all site functions; on multisite, a Super Admin can administer the network. Neither label alone proves what an account can do, because plugins, custom roles and custom code can add or remove capabilities.
The safest process is to document the current state, retain a trusted recovery administrator, reduce each account to the least powerful role that supports its work, handle post ownership before deleting users, revoke unused Application Passwords, inspect credentials inside connected plugins, and verify publishing, API and scheduled-job workflows afterward.
As an Amazon Associate I earn from qualifying purchases.
What this review should cover
A useful review is an access inventory, not just a count of users shown in the dashboard. It should answer five questions for every account and integration:
- Who or what owns the account, and can that owner still be reached?
- Which site or network can it access?
- Which capabilities does it actually have, including capabilities added by plugins or custom code?
- Which Application Passwords, API keys, OAuth grants or plugin tokens can act on its behalf?
- What content, automation or service would be affected if access were changed?
WordPress documentation describes a role as a bundle of capabilities and advises: “Only grant the capabilities required for the tasks the role is intended to perform.” Use that principle for both people and integrations. A person may need to publish articles but not install extensions; an integration may need to create posts through an API but not manage users.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prepare before changing access
Confirm the installation scope
Record whether the site is a single installation or part of a multisite network. A single-site Administrator has broad authority on that site. A multisite Super Admin has network-level powers, including administration of sites and network settings. A user can also have a role on one site and a different role on another, so a site-level review does not establish the person’s network access.
Keep a recovery path
Confirm that a second trusted administrator, or a network Super Admin for multisite, can sign in before you downgrade or remove anyone. Do not perform the review with the only known administrator account, and do not remove the account you are currently using: the Users screen does not allow the logged-in user to delete their own account.
Create a change log
Use a private record with one line per change. Include the account or credential name, current role, owner, reason for the change, action taken, date, affected service and verification result. The log is especially valuable when an integration fails several days later or when a former contractor asks why access disappeared.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallMap dependencies first
Before deleting a person, identify their posts, pages, links and scheduled work. Before disabling a plugin credential, identify the application, webhook, form, backup job or publishing workflow that uses it. Ask the owner to confirm the intended replacement or shutdown date. A backup and a documented rollback plan are prudent when the account controls a live store, membership system, forms, security monitoring or backups.
Inventory every privileged account in wp-admin
Use the Users screen
- Sign in with an authorized administrator account.
- Open Users in the wp-admin menu.
- Review every account, not only accounts currently showing the Administrator role.
- Open each relevant profile and record the login name, email address, role, post count and any visible Application Password entries.
- Contact the person or service owner to confirm that access is still required and what tasks it supports.
The Users list gives you a starting inventory. It does not prove that a role is safe or that an account is active in practice. Look closely at former contractors, generic shared logins, old agency accounts, dormant users, addresses at a former employer, and accounts whose role is broader than the owner’s current duties. These are review heuristics rather than WordPress classifications of unsafe accounts.
Check multisite separately
In multisite, inspect network users and the Super Admin list as well as each site’s local roles. A person can be a Super Admin even when their role on an individual site appears ordinary. Remove network-level access only after confirming that no other site, network plugin or operational task depends on it.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Record ownership, not just names
For a human account, record a named owner and a current contact method. For a service account, record the application, technical owner, environment and replacement contact. Shared logins make attribution and revocation difficult; where practical, replace them with individual accounts and narrowly scoped credentials.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Understand roles, capabilities and plugin additions
The default WordPress roles describe common duties, but they are not a complete access model.
| Role | Typical core capability | Review implication |
|---|---|---|
| Administrator (single site) | Access to all administration features for that site | Reserve for people who genuinely manage the whole installation. |
| Super Admin (multisite) | Network administration and all possible multisite capabilities | Treat as network-level privileged access, not merely a site role. |
| Editor | Manage and publish posts, including posts written by other users | May be suitable for editorial leads, but review any added capabilities. |
| Author | Create and manage the user’s own posts | Usually narrower than Editor, but still check publishing and plugin permissions. |
| Contributor | Draft posts without publishing them | Useful when submissions require editorial approval. |
| Subscriber | Manage the user’s own profile | Appropriate for profile-only access where no content work is required. |
Plugins and custom code can register new roles, add capabilities to existing roles, remove capabilities, expose custom endpoints or create alternative authentication paths. Therefore, changing an account from Administrator to Editor does not guarantee that it can no longer perform a sensitive action. If a bespoke access rule matters, inspect installed access-control extensions, role-management settings and custom code, and test the resulting account.
Match each account to current duties
Write down the tasks the owner actually performs, then select the least powerful role that covers those tasks. Separate content work from site administration: publishing another writer’s post may justify Editor, while installing extensions, changing themes, managing users or editing security settings generally requires broader capabilities.
- Remove administrative access that was granted for a one-time migration, launch or troubleshooting session.
- Use an individual account for each person so actions remain attributable.
- Give a vendor temporary access with an agreed end date, then downgrade or remove it.
- Do not grant Administrator merely because a plugin setup guide requested it; determine the narrower capability or temporary procedure that is actually needed.
- For custom roles, document the capabilities explicitly rather than relying on the role’s display name.
When a role is changed, ask the owner to test the exact tasks they need. A successful login is not proof that publishing, media uploads, moderation, reporting or API calls still work.
Downgrade or delete a user safely
Downgrade an account that remains needed
- Open Users and select the account.
- Confirm the retained administrator can sign in and that the owner agrees with the new scope.
- Choose the least powerful suitable role in the role control and save the change.
- Ask the owner to test the required workflow in a new session.
- Record the old role, new role, reason, date and verification result.
Delete an account that is no longer needed
- Confirm that the account has no remaining operational owner, scheduled task or integration dependency.
- Review its post and link counts and identify the person who should own that content afterward.
- Ensure another administrator can recover access before proceeding.
- In Users, select the account and choose the deletion action.
- When WordPress asks what to do with the user’s posts and links, choose either deletion or reassignment to the agreed owner.
- Complete the deletion, then test public content, editorial lists and any automation associated with the account.
Do not treat deletion as a substitute for credential revocation. A user may have Application Passwords or tokens stored in a plugin, and an external service may continue trying to authenticate until its own credential is disabled.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Review and revoke Application Passwords
Know what these credentials are
An Application Password is an individual credential for programmatic WordPress authentication. It is intended for an application or script using the API, not for interactive wp-admin sign-in. Each credential has a descriptive name and may show usage information such as a last-used time or IP address, depending on the site and WordPress version.
Review credentials from the user profile
- Open Users and select the account that owns the integration.
- Find the Application Passwords section in the profile.
- Compare each descriptive name and usage detail with the integration inventory and its owner.
- Ask about unfamiliar entries before revoking them, especially when a shared service account is involved.
- Revoke each credential that is obsolete, duplicated, ownerless or no longer required.
Use one credential per integration where possible. That makes a single service easy to disable without breaking unrelated applications. WordPress guidance states: “Revoke any credential that is no longer needed.” Revoking an Application Password does not change the account’s main interactive password.
Use WP-CLI when SSH access is appropriate
On a site managed through SSH, an authorized operator can list and remove credentials with WP-CLI:
wp user application-password list USER_ID
wp user application-password delete USER_ID UUIDReplace USER_ID and UUID with the verified account ID and credential UUID. Check both values carefully before deletion and record the command outcome. Application Passwords can be disabled or filtered by configuration, so their absence from a profile does not prove that every plugin or external credential has been removed.
Understand the boundary of this list
The profile’s Application Passwords list is not a universal inventory of OAuth grants, third-party API keys, hosting credentials, webhook secrets or tokens stored in a plugin’s own settings. For every connected service, open that product’s integration or credential screen and revoke the secret there according to its documentation. If the service owner cannot identify a token, treat it as a candidate for replacement rather than deleting it blindly from a production system.
Audit plugin permissions and credentials
Start with installed plugins
- Open Plugins > Installed Plugins.
- Record active and inactive plugins, their owners and the site function each supports.
- For each plugin, inspect settings for user-role controls, API access, webhooks, scheduled tasks, external connections and stored secrets.
- Ask the owner whether the plugin is still required and whether any credential can be rotated or removed.
A plugin list review alone cannot establish the complete access model. A plugin can add capabilities to a role, create a custom endpoint, permit remote publishing or expose an automation account. Read the plugin’s documentation and settings for the controls that apply to that specific extension.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Deactivate before deleting a standard plugin
For an unneeded plugin that appears in the normal list, WordPress’s documented sequence is to deactivate it first and then delete it. Deactivation lets you test whether the site still behaves correctly before files are removed. Check dependencies and user-facing behavior first, particularly for forms, commerce, backups, security, memberships and content display.
Free tools Windows power users keep installed
One-click scans. No signup required.
Inspect must-use plugins separately
Must-use plugins are automatically enabled, do not appear in the default Plugins list and cannot be disabled from that screen. The usual directory is wp-content/mu-plugins. Review the files and deployment process through the host or developer, and do not remove a must-use file without knowing how it was installed and what it controls.
Consider plugin-created roles
After deactivating or removing an extension, check whether it created roles, capabilities, scheduled jobs or stored credentials that require separate cleanup. The exact behavior differs by plugin. Preserve a backup and document the intended rollback if the extension supports critical content or operational functions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify changes without causing an outage
Test with the narrowest practical account
Use a test account with the revised role, or have the service owner perform the check. Verify login, dashboard visibility, content creation, publishing approval, media handling and any required reports. Confirm that a user cannot reach an administration screen that should now be outside their duties.
Test integrations and scheduled work
After revoking a credential or changing a role, trigger a safe API request or test job. Watch for failed publishing tasks, webhooks, form deliveries, backups, security alerts and scheduled events. Review application logs and the plugin’s own activity screen where available.
Have a rollback decision
If a necessary workflow fails, restore the smallest change that resolves the problem: reinstate the specific credential, restore the prior role temporarily or reactivate the plugin. Record why the rollback occurred, identify the missing capability or dependency, then redesign the access rather than leaving broad permissions indefinitely.
Common failure scenarios and fixes
“The user was downgraded, but can still perform a sensitive action.”
Check for capabilities added by a plugin, a custom role definition or custom code. Compare the account’s effective capabilities with the intended duties, remove the unnecessary capability at its source and retest with a clean session.
“Deleting the user removed the wrong content.”
Stop further changes, restore from the site’s recovery process if necessary, and verify whether the deletion choice removed or reassigned posts and links. Before retrying, establish the intended content owner and use reassignment rather than deletion when authorship must be preserved.
“An API integration stopped after revocation.”
Identify the exact application and credential from its error log. If the revoked Application Password was still required, issue a replacement dedicated to that integration, update the service securely and test it. Do not restore every old credential just to make the error disappear.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →“The plugin is absent from the Plugins screen.”
Check whether it is a must-use plugin in wp-content/mu-plugins, managed by the host, bundled by a deployment process or loaded by custom code. Involve the person responsible for server access before changing files.
“Removing a plugin broke a site feature.”
Reactivate the plugin if that is safe, restore the documented backup when needed and identify the dependent feature. Then decide whether the plugin should remain, be replaced or be removed during a planned maintenance window.
Keep the access model healthy
WordPress security guidance treats access review as continuing maintenance. Keep WordPress core, plugins and themes updated; prefer extensions that are actively maintained; and maintain a tested recovery path. Updates reduce known vulnerabilities, but they do not replace least-privilege decisions or credential cleanup.
Set a review cadence appropriate to the site rather than assuming a universal interval. Revisit access after staff departures, contractor changes, agency handoffs, ownership transfers, major launches and plugin replacements. A high-change multisite or membership platform may need more frequent checks than a small brochure site.
| Decision | Use this when | Key caution |
|---|---|---|
| Change a role | The person still needs a WordPress login but has narrower duties. | Test effective capabilities, not just the new label. |
| Delete a user | No ongoing human access is required. | Choose whether posts and links are deleted or reassigned. |
| Revoke an Application Password | One API credential is obsolete or unknown. | It affects that credential, not the account’s main password. |
| Deactivate a plugin | You need to test removal of a standard extension. | Check dependencies and visible site behavior. |
| Delete a plugin | Deactivation testing shows it is no longer required. | Must-use plugins follow a separate path. |
A repeatable review checklist
- Identify single-site or multisite scope.
- Confirm a second trusted recovery administrator.
- Export or record users, roles, emails and post counts.
- Contact each owner and document the business reason for access.
- Inspect Super Admin access separately on multisite.
- Map default, custom and plugin-added capabilities.
- Downgrade accounts to the least powerful suitable role.
- Confirm post and link ownership before deleting users.
- Review and revoke unused Application Passwords.
- Inspect plugin-specific tokens, OAuth grants, webhooks and API keys.
- Review active, inactive and must-use plugins.
- Deactivate before deleting a standard plugin.
- Test affected human and automated workflows.
- Record the result and schedule the next review after relevant organizational or technical changes.
Bottom line
Start with the Users screen, but do not stop at role labels. Effective WordPress access is the combination of site or network role, capabilities added by plugins or code, human credentials and integration secrets. Preserve content ownership, revoke each obsolete credential at the system that issued it, treat must-use plugins as a separate audit surface, and verify every change with the workflow owner. This produces a smaller, explainable access model without guessing which live services can safely be removed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
