An old account may belong to a former editor, a current integration or a customer who rarely signs in. Those cases require different decisions. An account audit should establish purpose and ownership before deciding what to remove.
Begin with privileged accounts. Identify the authorized person or service behind each Administrator and any custom role with broad capabilities. Compare the assigned access with current responsibilities. A temporary setup account that nobody owns deserves prompt investigation.
Do not assume WordPress core provides a complete last-login history in every installation. A plugin may add activity information, but its absence does not prove an account has never been used. Combine available evidence with project records and confirmation from the responsible team.
An integration account can be quiet in the browser while actively using an application password. Check automated connections before disabling it. Give service accounts descriptive names and documented owners so they do not look like abandoned personal accounts at the next review.
For content contributors, inspect drafts and published work before deletion. Decide whether access can be reduced, removed or transferred without changing the intended attribution. Use the platform's reassignment options carefully and check extension-specific records separately.
Customer and member accounts require a different policy from staff access. Retention, contractual needs and user requests may affect what should remain. Do not run a bulk deletion simply because a date field looks old; first understand what the field measures and which business process uses the account.
Record the outcome of the review: retained with a reason, role adjusted, ownership clarified or access removed. Keep the record free of passwords and unnecessary personal details. Set another review when staffing or integrations change. A short, purposeful inventory is more useful than repeatedly deleting names that nobody recognizes and repairing the consequences afterward.
Where evidence is missing, assign a follow-up rather than treating uncertainty as permission to delete.
