Writing settings

Housekeeping, not a security category

This group is the plainest one in this reference and it is worth saying so rather than dressing it up: these are database-hygiene checks, not security checks. Every edit to a post creates a revision by default, every autosave creates another, and WordPress keeps all of them indefinitely unless something tells it not to. On a site with years of content and no housekeeping, that adds up to a posts table carrying several times more revision and autosave rows than actual published content, which does nothing dangerous but does make every query against that table slower than it needs to be, and makes database backups larger and slower to restore for no benefit.

Trashed and draft posts pile up the same way: WordPress does not delete anything unless told to, so a trash folder nobody empties and a stack of abandoned drafts both sit in the database forever by default. Post-via-email settings and the default post category are smaller still: mostly relevant if left misconfigured in a way that causes published content to land somewhere nobody expects it, rather than anything an attacker would use.

None of this needs urgency. It needs to happen occasionally, especially on older sites that have accumulated years of unmanaged revisions, because the payoff is a smaller, faster database rather than a closed vulnerability.

Across a portfolio, the value of grouping these checks together is mostly about noticing the sites nobody has touched in this way for years, rather than the ones where a developer already set sensible revision limits from the start. A single site with bloated revisions is a five-minute tidy-up. Twenty of them, discovered at the same time because nobody was tracking it, is a much longer afternoon.