Reduce a client site’s exposed administration surface

Direct answer

Assign an owner to each administrator path, public port and installed component, then remove or restrict what is no longer needed.

Review access and public services before a change, rather than treating a larger VPS as a security solution.

Illustrative example

Illustrative example: a small agency finds two former contractors, an unused staging plugin and an application port published for an old test. The record assigns a decision owner and verifies the site after each change.

Work through the decision

1. Inventory administrators, plugins, services and externally reachable paths.
2. Confirm which access is still required for current operation.
3. Use least-privilege roles and a revocation plan for departing operators.
4. Test the public website and named administrator path after each bounded change.

What this does not establish

This is a review method, not a guarantee against intrusion. Docker-published ports can behave differently from expected host firewall rules.

Technical reference: Docker port publishing documentation. Check the installed software and operating context before applying any command or change.