diagnostic-user-audit

Diagnostic Skill: User Account Audit

You audit WordPress user accounts for common security issues that increase the risk of unauthorized access or account compromise.

Scope: Standard Security Checks Only

Per user decision, this skill checks ONLY standard user account security issues. It explicitly DOES NOT check advanced analytics like email domain analysis, capability overrides, or subscriber ratios.

What we check:

1. Default 'admin' username (Critical - most targeted username)
2. Excessive administrator accounts (Warning - increases attack surface)
3. Inactive privileged users (Warning - best-effort, requires last login tracking)

What we explicitly skip:

• Email domain analysis (e.g., @gmail.com for admin users)
• Custom capability overrides
• Subscriber-to-admin ratios
• User registration settings (separate check)

How It Works

1. Load site connection details from sites.json
2. Run three checks via WP-CLI over SSH
3. Generate structured findings with deterministic IDs
4. Handle graceful degradation if last login tracking unavailable
5. Return findings as JSON array

Connection Details

# Read site profile
SITE_NAME="${1:-default-site}"
PROFILE=$(jq -r ".sites[\"$SITE_NAME\"]" sites.json)

HOST=$(echo "$PROFILE" | jq -r '.host')
USER=$(echo "$PROFILE" | jq -r '.user')
WP_PATH=$(echo "$PROFILE" | jq -r '.wp_path')
WP_CLI_PATH=$(echo "$PROFILE" | jq -r '.wp_cli_path')

Security Checks

Check 1: Default 'admin' Username

Risk: Critical - 'admin' is the most commonly targeted username in brute force attacks.

Detection:

# Get all usernames and check if 'admin' exists
ssh -o BatchMode=yes "${USER}@${HOST}" \
  "cd ${WP_PATH} && ${WP_CLI_PATH} user list --field=user_login --format=json" 2>&1

Parse JSON array and check if 'admin' exists in the list.

If found: Generate Critical finding.

Finding ID: SECR-USERS-ADM (deterministic)

Finding:

{
  "id": "SECR-USERS-ADM",
  "severity": "Critical",
  "category": "Security",
  "title": "Default 'admin' username in use",
  "summary": "The default 'admin' username exists on this site, making brute force attacks more likely to succeed",
  "detail": "A user account with the username 'admin' exists in the WordPress database. This is the default administrator username created during WordPress installation and is the most commonly targeted username in brute force attacks. Attackers only need to guess the password, not the username, significantly reducing security. WordPress.org recommends using unique, non-obvious usernames for all administrator accounts.",
  "location": "User: admin",
  "fix": "Create a new administrator account with a unique username: Go to Users > Add New in WordPress admin, create a new administrator account with a strong, unique username (not 'administrator', 'root', or site name). Log in with the new account, then delete the 'admin' account. WordPress will prompt you to transfer all content ownership to another user - select your new administrator account. IMPORTANT: Ensure the new account has full administrator access before deleting 'admin'."
}