Case: Cutting 22 Admins to 4 Shrank the Blast Radius

Case: Cutting 22 Admins to 4 Shrank the Blast Radius
A media site had 22 accounts with administrator role. Nobody could say why. Two belonged to ex-contractors still active.

Least-privilege SOP:

— Step 1: Export all users + roles. Flag every administrator.
— Step 2: For each, answer one question: do they install plugins or edit other users? If no, they are not an admin.
— Step 3: Demote to editor or author. 18 accounts demoted.
— Step 4: Delete the 2 ex-contractor accounts, reassign their content to a service account.
— Step 5: Re-export and verify the admin count.

Outcome: 22 admins → 4. The next phishing hit landed on a demoted editor — attacker got no plugin-install capability, no payload deployed.

Run this every time.