How to Audit Every AI Credential on a WordPress Site

Inventory every credential used by an AI assistant, plugin, connector or client, then make an explicit retain, rotate, revoke or investigate decision for each record. This is an ownership and lifecycle audit, not a connection troubleshooting sequence.

Inventory schema

FieldEvidence to collect
IntegrationPlugin, assistant, client, MCP server or backend name and version
WordPress identityUsername, role and relevant capabilities
CredentialType, visible label, creation date, last-used time and last IP when WordPress exposes them
PurposeApproved task, environment and responsible owner
ExposureRoute, method, ability or tool the integration can request
LifecycleCreator, rotation rule, revocation trigger and recreation behavior
DecisionRetain, rotate, revoke or investigate, with approver and date

Never copy the secret value into the inventory.

Collection procedure

  1. List every plausible WordPress user instead of inspecting only the current administrator.
  2. Record Application Password metadata from each relevant profile and correlate labels, dates and last-use evidence with known integrations.
  3. Inventory plugin-specific tokens, connector configuration and MCP credentials from their authorized control planes without exporting secret values.
  4. Map each assistant or client to one WordPress identity and one approved purpose. Record shared or ambiguous ownership as a finding.
  5. Compare installed versions and behavior with primary documentation and changelogs.
  6. Test revocation only after the owner, purpose and rollback consequence are recorded.

Disposition matrix

FindingDecision
Current owner, approved purpose, narrow capability and recent expected useRetain until the next review date
Approved integration but weak name, shared ownership or overdue rotationRotate into one named credential and retire the predecessor
Departed owner, retired integration, duplicate or confirmed unused credentialRevoke and verify that authentication fails
Unknown owner, unexplained recreation or contradictory evidenceInvestigate before revocation; isolate the workflow if risk requires it

Evidence and sign-off

The final register must account for every observed credential, document unresolved gaps, identify the decision owner and schedule the next review. Evidence may include sanitized profile metadata, versioned configuration references, refusal results and revocation results. It must not include Application Passwords, Authorization headers, tokens, cookies, customer domains or personal data.

Frequently asked question

When should the audit be repeated?

Repeat it after plugin or client changes, staff changes, environment cloning, incident response and at the review interval assigned to each retained credential.

Sources and verification

This page was checked against the following primary sources. Last source review: .