Reducing exposure.
WHY IT MATTERS
Every installed component is potential exposure.
Unused ones are worse, because nobody maintains them.
WHAT TO REMOVE
Plugins you do not use Themes you do not use Old applications in subdirectories Unused accounts Old backup files
THE DEACTIVATED PLUGIN POINT
Deactivating is not removing.
Deactivated plugin files can still be exploited.
Delete them.
THE OLD INSTALLATION PROBLEM
An application installed years ago in a subdirectory, forgotten, never updated.
The most common route of compromise on accounts with several sites.
HOW TO FIND THEM
Look through every directory in your account.
Account for all of them.
WHAT YOU WILL FIND
Test installations Old site copies Applications from a previous developer
BEFORE DELETING
Back up, and check nothing depends on it.
HOW OFTEN
Twice a year.
