How to audit remote access and API keys on a business website

In October 2026 two WordPress vendors had to tell customers that a channel they trusted had been used against them. TeamUpdraft found unauthorised access to teamupdraft.com over the weekend of 17 and 18 October, and the data it believes was taken includes the connection keys for UpdraftCentral, its remote management service. A few days earlier, Rank Math PRO 3.0.123 went out with malware to people who downloaded it during a window of about eleven hours. The attackers did not need a weak password on any victim's site: they came in through connections the owners had approved, in some cases without knowing it.

This guide is for any business with a website or an online shop, whether it runs on WordPress, WooCommerce, Shopify or a custom stack. It shows how to list every service that holds a key to your site, how to revoke the keys nobody needs, when to rotate the rest and what to put in writing with vendors and agencies.

#What happened in the UpdraftCentral breach

According to the TeamUpdraft incident notice, the company believes its customer database was accessed. That database holds names, email addresses, hashed passwords, two-factor settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card data is handled by Stripe and PayPal and was not stored. The attacker used the connection to customer sites to create admin accounts and install malicious plugins, and TeamUpdraft later warned about a pattern of unexpected Editor accounts. UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), released on 19 October, disconnect every UpdraftCentral connection made before 13:07 BST on 18 October.

Patchstack’s analysis explains why ordinary defences did not help. The commands were signed with genuine dashboard keys, so every check in the plugin passed. A connected site runs any signed command with the permissions of the user who created the connection, and nobody confirms individual commands. Many owners never chose this: when you connected a TeamUpdraft.com account, a checkbox that added the site to UpdraftCentral was ticked by default. Keys also did not expire, and Patchstack saw keys issued in November 2025 still working in October 2026. The backdoor accounts looked like Editors while holding the manage_options and install_plugins capabilities, so a review of the administrator list missed them.

#What happened with the Rank Math PRO download

Rank Math’s statement says that PRO 3.0.123 downloaded between 15 October 20:02 UTC and 16 October 07:12 UTC contained malware, and 3.0.124 is the clean release. The free version on WordPress.org was not affected. For sites that activated the bad build, Rank Math asks owners to assume that every secret on the site is exposed, and lists what to change: WordPress passwords, database credentials, the security keys and salts in wp-config.php, payment gateway keys, SMTP credentials, other API keys, hosting, FTP and SSH access, and two-factor settings for administrators.

That list is the best short description of what a website holds. Your site stores keys to other systems, and other systems store keys to your site. Both directions belong in the audit. Our article on supply chain attacks in 2026 covers the wider pattern behind these incidents.

#How to find which services can access your website

Collect the list from three places: the site itself (users, plugins or apps, settings), your company accounts (invoices, the password manager, the email inbox where signup confirmations land) and your infrastructure (DNS, CDN, hosting panel, code repository). For each entry write down the service, what it can do, who created the key, where the key lives on both ends, when it was last used and who in your company owns it. An entry without an owner is the first candidate for removal.

#Remote management dashboards

UpdraftCentral, ManageWP, MainWP and Jetpack connect to a WordPress site through a component installed on it: UpdraftPlus carries the UpdraftCentral client, ManageWP uses the ManageWP Worker plugin and MainWP uses MainWP Child. The dashboard keeps its half of the credentials on the vendor’s servers or on a server your agency runs. Check the plugin list, including the must-use tab, and ask your agency which dashboards it uses on your site. Patchstack’s main lesson applies to every product of this type: removing the site from the dashboard is not enough, because the key that matters sits on the site.

#Store apps and integrations with API access

On Shopify, open Settings, Apps and click each app. The Activity and permissions section on the app’s page shows which store areas it can view or edit and when it last used each of them. Permissions the app has not used in the last 30 days appear under Unused access, according to Shopify’s documentation. The read_all_orders scope extends an app’s reach beyond the default window of orders from the last 60 days (access scopes), so ask why an app needs it. Before you uninstall an app, export what you need: Shopify warns that some apps store data you cannot recover afterwards.

In WooCommerce the keys are under WooCommerce, Settings, Advanced, REST API. Each key is linked to a WordPress user and has Read, Write or Read/Write access, and the consumer secret is shown only once (WooCommerce REST API). Check which user every key belongs to and whether that person still works with you.

#Application passwords and API users

WordPress application passwords let a tool log in to the REST API with Basic Auth. You create and revoke them on the Edit User screen. Core does not scope them yet: the integration guide lists scoping as future development, so an application password can do whatever its user can. WordPress records the last use (accurate to within 24 hours) and the last IP address. With WP-CLI:

wp user list --role=administrator
wp user list --role=editor
wp user application-password list 1 --fields=name,created,last_used,last_ip

The editor list matters after the UpdraftCentral case, because the backdoor accounts were Editors with extra capabilities.

#CDN and DNS tokens

A token with DNS edit permission can point your domain or your mail records somewhere else. In Cloudflare, an API token is limited to chosen permissions and zones and can be restricted further with client IP filtering and a TTL (create a token). The older Global API key has access to all of a user’s resources with that user’s full permissions, and Cloudflare does not recommend it for new use (Global API key). If a plugin, a CI job or a cache purge script still uses the Global API key, replace it with a token scoped to one zone.

#Deploy keys

A GitHub deploy key is an SSH key that grants access to a single repository. It is read-only by default, and with write access it can do what an organisation member with admin access can do. According to GitHub’s documentation, deploy keys have no expiry date, usually have no passphrase, and stay active when the person who added them is removed from the repository. Review them in the repository under Settings, Deploy keys, delete the ones you do not recognise and approve the valid ones.

#Payment and email provider keys

Payment keys usually sit in the shop’s plugin settings or in environment variables. Stripe lets you create restricted keys with permissions you control, and when you rotate a key in the Dashboard you choose when the old one expires: “Now” deletes it at once, a later time gives the integration a window to switch (Stripe API keys). Email works the same way: an SMTP password or a transactional provider’s API key sits in a plugin or in wp-config.php. Our SMTP guide shows where these settings live.

#Backup services

A backup holds a full copy of the database, with customer data and every key stored in settings. TeamUpdraft disconnected all sites from UpdraftVault and issued new credentials. For sites accessed through UpdraftCentral it also recommended re-authorising remote storage such as Google Drive, Dropbox or Amazon S3 and changing the storage access keys. Check who can read your backup storage, and whether the backup tool’s credentials allow deleting old copies.

#Website access audit checklist

#How to revoke an API key without breaking the site

On a healthy site, work in this order. Find what uses the key: its description, last use and the logs of the tool that calls it. Create the replacement with narrower permissions where the platform allows it. Put the new key into the consuming tool and confirm it works. Revoke the old key and watch for a few days for failed orders, missing emails and broken deployments. Stripe’s expiration window exists for exactly this switch.

On a compromised site, reverse the order: revoke first and accept that some integrations will stop until you reconnect them. TeamUpdraft’s instructions for UpdraftCentral users follow that logic: log in to each site directly, update, delete the connection key, remove unknown accounts and plugins, change admin passwords and only then reconnect. Revoke on both ends whenever there are two. A key deleted only in the vendor’s panel can still be accepted by the site, and a key deleted only on the site can still sit in the vendor’s database.

#When to rotate API keys

Rotate on events, because a calendar alone would not have helped anyone in October 2026. The triggers worth writing into your procedures:

• a security incident at a vendor that holds a key to your site or receives one from it,
• malicious code that ran on your site, which means everything on Rank Math’s list above,
• a person, freelancer or agency losing access,
• a key found where it should not be: a repository, a support ticket, an email thread or a screenshot,
• an integration replaced by another tool.

Add one fixed review a year on top of that, and delete every key nobody can explain. Keys without an expiry date, like GitHub deploy keys or the UpdraftCentral keys Patchstack examined, stay valid until someone removes them.

#What to require from your agency and software vendors

An agency that maintains your site creates keys in your name. Put these points in the contract or the maintenance scope:

• A register of every key, token and account the agency creates, with purpose and owner, handed over on request and at the end of the contract.
• Keys created in your accounts where the platform allows it, for example a Cloudflare token in your Cloudflare account scoped to your zone, so revoking it does not depend on the agency.
• One key per site and per tool, and named user accounts instead of a shared “agency” login.
• Revocation of all access within an agreed number of days after the contract ends, confirmed in writing.
• A notice deadline for incidents. Under Article 33 GDPR a processor has to notify the controller without undue delay, and the controller has 72 hours, where feasible, to notify the supervisory authority. Write a concrete number of hours into the contract so nobody argues about “undue”.

Before you install anything with remote features, ask the vendor whether the remote connection is switched on by default and whether its keys expire. For UpdraftCentral, Patchstack’s answers were yes and no.

We run this audit as part of a WordPress security audit and keep the register current in website maintenance. For WooCommerce shops it is part of the store reliability plan, and for Shopify stores we review app permissions as part of Shopify development. If you want to see how plugin updates reach your site and where a tampered release could slip in, read about the WordPress.org 24-hour update delay and four plugin backdoors in one month.