Website access management means knowing who can log in to your website, hosting, domain and email, and removing that access the day someone leaves. Former staff and contractors with admin logins are a quiet risk, because nothing looks wrong until a login is misused. A short offboarding routine and a regular access review close the gap.
Key takeaways
- Every person should have their own login. Shared passwords make it impossible to remove one person cleanly.
- When someone leaves, check four places: the website, hosting, domain registrar and email.
- Give people the lowest role that lets them do their job. Most don’t need Administrator.
- Review your user lists every quarter, not only when someone leaves.
Why do old logins matter?
An old login is a door nobody is watching. The person who held it might mean no harm, but their email or password could be stolen later, or reused on another site that gets breached.
Attackers like admin accounts because they look legitimate. Sucuri found malicious admin users in 55% of the infected databases it cleaned (Sucuri). An extra administrator that nobody recognises is a warning sign. One that belongs to someone who left two years ago is easy to miss.
Email matters just as much. Email compromise was the most common cybercrime reported by Australian businesses in 2024–25, at 19% of reports (ASD). A former employee’s mailbox that still receives password resets is a direct route into your other accounts.
What should I do the day someone leaves?
Work through the four areas below on their last day, or before if the exit isn’t friendly.
The website
In WordPress, go to Users and find their account. If they wrote posts, choose “Attribute all posts and links to” another user when you delete them. The other option deletes their content too (WordPress.org).
Check for application passwords on their Edit User screen as well. These let other apps log in without the main password, and they can be revoked from that screen (Make WordPress Core).
Hosting, domain and email
Hosting control panels, SFTP accounts and SSH keys sit outside WordPress, so removing a website user doesn’t touch them. At the domain registrar, the contact email matters most: whoever receives it can usually reset the password. Our guide on who owns your domain explains how to check.
How do I stop this becoming a mess again?
- One person, one login. Never share an admin account. Named logins can be removed one at a time and show who changed what.
- Use the lowest role that works. WordPress describes an Administrator as “somebody who has access to all the administration features” (WordPress.org). Someone writing blog posts needs Editor or Author, not that.
- Keep shared credentials in a business password manager, so you can see who has access and change a password in one place.
- Turn on two-factor login for every admin account. Our guide to a secure WordPress login covers the settings that matter.
- Use role-based email addresses such as admin@ or accounts@ for registrars, hosting and plugin licences, never a staff member’s own inbox.
- Review access quarterly. Remove anyone who no longer needs it, including old agencies and freelancers.
What about contractors and agencies?
Contractors often need admin access for a short job, then keep it for years. Give them their own account, set a reminder for the end of the project, and remove or downgrade them when the work is done.
The same goes for plugins and services you connect to the site. Each one is a kind of access too, and a trusted tool can be compromised. Our explainer on a plugin supply chain attack shows how that happens.
Handing over from a web developer who’s leaving is a bigger job. Our website handover checklist covers what to collect before they go.
Who should own this in a small business?
Pick one person, usually the owner or office manager, to keep a simple access register: each system, who has access, what role and when it was last reviewed. A spreadsheet is fine. For broader habits, see our guide to small business cyber security in Australia.
The technical side can sit with your provider. Our website security monitoring adds a firewall, login protection, malware scanning and blacklist monitoring. It’s part of every one of our website maintenance plans, starting with a security audit and lockdown at setup. On the server side, secure web hosting should let you give each person their own control panel or SFTP login.
Frequently asked questions
Should I delete a former employee’s WordPress account or just change their password?
Delete it, or downgrade it to Subscriber if you need to keep a record. Changing the password still leaves the account, its email address and any application passwords in place. When you delete, attribute their posts to another user so their content stays on the site.
Is it okay to share one admin login among the team?
No. A shared login can’t be removed for one person without locking everyone out, and you can’t tell who made a change. Give each person their own account with the lowest role that lets them work, and use a password manager for anything that genuinely must be shared.
How do I find out who has access to my website?
In WordPress, open Users and filter by Administrator. Then check your hosting control panel for extra FTP, SFTP or database users, and your domain registrar for other contacts. If you can’t log in to one of these, that’s the first problem to fix.
What if a former staff member set up our domain in their own name?
Ask them to update the registrant and contact details to the business while you’re on good terms. For a .com.au, the licence should be held by the business, since eligibility comes from its ABN or ACN. If they won’t cooperate, talk to your registrar about the formal change process.
How often should we review website access?
Every quarter, and whenever someone leaves or a project with an outside contractor ends. A regular review is the easiest way to spot an account that shouldn’t be there, before someone else uses it.
Sources
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- Annual Cyber Threat Report 2024–25, Australian Signals Directorate, October 2025
- Users screen, WordPress.org Documentation, updated 23 October 2024
- Application Passwords: Integration Guide, Make WordPress Core, 5 November 2020
- Roles and Capabilities, WordPress.org Documentation, updated 2 September 2026