The short answer
Give every person their own login with the lowest WordPress role that lets them do their job: Contributor or Author for writers, Editor for content managers, Administrator for one or two trusted owners. Remove accounts the day someone leaves, and review the user list quarterly. Never share a single login.
The five WordPress roles, in plain English
WordPress ships with built-in roles. Each role is a bundle of permissions. WordPress.org's documentation describes them as follows: an Administrator has access to all the administration features within a single site, an Editor can publish and manage posts including the posts of other users, an Author can publish and manage their own posts, a Contributor can write and manage their own posts but cannot publish them, and a Subscriber can only manage their own profile.
The table below translates that into what it means for a business site. Details can differ if your site uses a membership or shop plugin, because plugins can add their own roles such as Shop Manager.
| Role | Can do | Cannot do | Typical person |
|---|---|---|---|
| Administrator | Everything on the site: settings, plugins, themes, users, all content | Nothing is off limits, which is the risk | The owner, plus the agency while they work on the site |
| Editor | Publish, edit and delete any posts and pages, manage categories, moderate comments | Install plugins or themes, change site settings, manage users | Marketing lead or content manager |
| Author | Write, publish and delete their own posts, upload images | Edit other people's posts, edit pages, change anything on the site | Regular blog writer you trust |
| Contributor | Write and edit their own posts and submit them for review | Publish, or upload images | Guest writer or new hire whose work needs checking |
| Subscriber | Log in and edit their own profile | Create or change any content | Members area users, newsletter or course sign-ins |
Super Admin is a seventh role that exists only on a WordPress Multisite network, where one installation runs several sites. Most business sites do not use it.
Least privilege: the rule that saves you
Least privilege means every person has the minimum access needed for their job. It sounds strict, but it is mostly a kindness. A person who cannot install plugins cannot break your site by installing the wrong one. A person who cannot publish cannot post the wrong draft by accident. When something does go wrong, the list of people who could have caused it is short.
It also limits the damage if an account is stolen. A criminal who takes over a Contributor account can do very little. A criminal who takes over an Administrator can install anything, add new administrators and lock you out. The WordPress hardening guide stresses the same idea for the database, giving it only the access it needs for day-to-day work.
A practical test: ask what is the lowest role that lets this person finish this week's work. Start there. You can always promote someone later in thirty seconds. You cannot undo what an over-powered account did while nobody was looking.
How to add a user
- 1Log in to your site's dashboard with an Administrator account.
- 2Go to Users, then Add New.
- 3Enter the person's own work email address and a username that is not generic. Avoid admin, webmaster or shared names.
- 4Choose the role. If in doubt, choose the lower one.
- 5Leave the option to send them a notification email on, so they set their own password. Do not set a password for them and tell it to them over chat.
- 6Ask them to turn on two-factor sign-in the first time they log in.
- 7Write the person, role, date and reason in a simple access list you keep. This is the record you will use at offboarding.
How to remove a user, and what to do with their content
Do this the day someone leaves, not at the next review. A former employee who still has a login is not usually malicious, but their email account may be hacked later, or their laptop stolen, and then your site is at risk.
- 1Go to Users, hover over the person and choose Delete.
- 2WordPress will ask what to do with the content they created. Choose Attribute all content to and pick an existing user, usually the owner or editor. If you pick delete all content, their posts and pages disappear. Almost nobody wants that.
- 3Confirm. If you are unsure, demote the account to Subscriber first. That removes the power but keeps the record while you decide.
- 4Check other places they might have access: your email provider, hosting, analytics, Search Console, ad accounts and social media. The ownership audit covers these.
- 5Change any password the person knew and that is shared with others. The best fix for the future is to stop sharing passwords.
If someone leaves on bad terms, remove access first, then tell them. Order matters. If they ever had an Administrator role, also read suspected hack and ask us to review the user list and installed plugins.
Offboarding checklist for a small team
- Website: delete or demote the user, reassign their content.
- Email: close or forward their mailbox. Reset requests for every other service land here, so it matters.
- Domain and hosting: confirm they were never the account holder. If they were, transfer it now.
- Google tools: remove from Analytics, Search Console and Business Profile.
- Ad accounts and social pages: remove, and check that billing is not on their personal card.
- Password manager: take back any shared vault items and rotate those passwords.
- Second-step devices: make sure their authenticator or security key is not the only way into a shared account.
Example: A designer who still had the keys
A small restaurant group worked with a freelance designer for a refresh two years ago. The designer was given an Administrator login and never removed. A year later the designer's email account is breached, and the attacker finds an old message containing the restaurant's site address. They try a password reset on the Administrator account. Because the designer still had two-factor sign-in on the site, the attempt fails. Nobody noticed that the account existed until the restaurant reviewed its users during an access audit and removed it. The lesson is not that freelancers are risky. It is that every account without an owner is a door nobody is watching. A quarterly check of the user list takes five minutes.
Webtec and your user list
When we work on your site, we may need an account for a period of time. We never ask for your password, and we do not need you to share yours. Tell us who needs access and at what level, and we will set it up so that each person has their own login. If you want an account removed when a project ends, say so in your request and we will help you do that. Your proposal sets out the working arrangement.
When to ask us
Ask us when you are unsure which role fits, when you do not know who has an Administrator account, when a user cannot be deleted, when a former team member still seems to have access, or when someone is sending you a login that they say belongs to us.
Send a request through the support form with: the site address, the names and email addresses of the people to add or remove, the role you think each needs, and the date the change should take effect. If you need a full user list review, say so. Do not send any passwords. We can create accounts that send the person their own set-up link.
