I agree with the suggestions above. Wordfence and WPScan are useful starting points for WordPress websites. However, if your website stores user data, I would also recommend looking beyond automated scanning.
Automated tools can identify known vulnerabilities, but they may not detect issues such as authentication weaknesses, access-control problems, or business logic flaws.
Regular vulnerability assessments and penetration testing can provide a deeper understanding of your website’s security and help identify weaknesses before they are exploited.
It’s also important to keep WordPress, themes, and plugins updated and maintain regular backups.
I agree that those tables should not be deleted until their purpose has been confirmed. In addition to checking plugins and custom code, I would recommend taking a complete database backup and testing the cleanup on a staging copy first. Searching for references to wp_2_users and wp_2_usermeta is a sensible step before making any changes. It is always better to verify dependencies before removing database tables, especially on an older multisite installation.
