The last couple of weeks I’ve occasionally glanced at Jetpack and then dismissed it as probably too bloated with premium features to have it running on my site.
Today I decided that the features of Jetpack probably merit an install (preferable to maintaining three or four other light plugins) , and there is a page to explicitly disable any surplus modules in the plugin (although not linked from the GUI).
All correct, I thought. Then I found the centralised management – which lets the associated wordpress.com login install arbitrary (uploaded!) plugins and invite new admin users.
Suddenly the wordpress.com user is high value and merits two factor authentication, recovery codes and explicit Sign Out clicks.
There’s good indication that there should be a related module to disable – the categories in in Jetpack modules show “Centralised Management (1)” but it doesn’t list anything when selected.
Let’s see what feedback the support forum has.