A WordPress security audit on one site is a checklist. On a fleet it is a list of admins you did not create, failed logins, and hardening constants that were never set. That is the first pass. mcp security, as people type it, is often the protocol. Here it is also: the model cannot write.
The unexpected admin
You name the accounts you recognise. Anything else in administrator is high severity. An empty known list only says “this site has four admins” — which teaches nothing. A filled list says “cmspanel is not yours”.
What MCP is allowed to see
Inventory and the last stored report. Not a password. Not a write. If you need to remove the account, you confirm in the dashboard. The audit log keeps the action.
Constants that should already be there
DISALLOW_FILE_EDIT at least. DISALLOW_FILE_MODS when the host allows it. A security audit that never looks at wp-config is a scan of symptoms, not of the door.
