WordPress user access is easy to overlook until several people need to edit the site, a freelancer finishes a project or an integration needs to connect. The quick answer is often to share the administrator login. It is also the answer that makes later changes harder to control.
A better setup gives each person or system its own route in, with enough permission to do the job and no more. This does not need a complicated policy. A short access list and a regular review will cover most small-business websites.
Start with the work, not the role name
Write down what each person actually needs to do. Someone preparing articles may need to write and upload images. A colleague managing the whole content calendar may need to edit other people’s posts. A developer investigating a fault may need broader access for a limited period.
WordPress includes several standard roles. Its official roles and capabilities guide describes an Administrator as someone with access to all administration features on a single site. An Editor can publish and manage posts, including other users’ posts. An Author manages their own posts, while a Contributor can write and manage their own posts but cannot publish them. A Subscriber can manage only their profile.
Those labels are a starting point. Plugins can add permissions or change what a role can reach, so check the account on the website itself rather than relying on the name alone.
Use the lowest role that completes the job
Do not make somebody an Administrator because it avoids a five-minute conversation. Ask which screens and actions they need. Give them the lowest suitable role, then increase it if a real task is blocked.
This matters most with temporary suppliers. If a copywriter only needs to draft articles, access to plugins, themes and site settings serves no useful purpose. If a developer needs administrator access to complete agreed work, record why it was granted and when it should be reviewed.
Give every person an individual account
A shared login hides who made a change. It also leaves an awkward job when one person departs: changing the password interrupts everybody, while leaving it unchanged means former users may still know it.
Individual accounts make access easier to remove without affecting anyone else. They also let WordPress attribute content and revisions to the right user. Use a business-controlled email address where practical, and ask each user to set a strong, unique password. Multi-factor authentication is worth considering when the website’s setup supports it.
Keep passwords out of handover documents, email chains and project notes. A handover can record the account owner, role and recovery route without containing the secret. The small-business website handover checklist covers the wider ownership details that should be settled around launch.
Keep integrations separate from human logins
A service that sends content to WordPress or reads information through its API should not borrow somebody’s everyday password. WordPress Application Passwords are revocable credentials created for programmatic access. Each one is tied to a WordPress user and can be withdrawn without changing that user’s main password.
Create a separate Application Password for each approved integration and give it a name that explains its purpose. Use HTTPS, store the credential in an approved secret store, and revoke it when the connection is retired. The WordPress user behind the credential still matters because the integration inherits that account’s permissions.
Use a simple join, change and leave routine
An access list can be modest. For each person or integration, record:
- the account name and owner;
- why access is needed;
- the assigned role;
- whether the access is ongoing or temporary;
- the date it was last checked.
Review the list when somebody joins, changes responsibilities or leaves. Remove accounts that are no longer needed. If an old account owns published content, decide who should take responsibility for it before deletion. Revoke unused Application Passwords separately, since removing one connection should not disturb another.
Keep one controlled recovery route
The business should know who controls the main administrator account and its recovery email. Do not use that account for routine editing. Keep it for work that genuinely needs full administration rights and for recovery when another account fails.
Check that the recovery email still reaches the right person and that the business can access the domain and hosting accounts connected to the site. WordPress access alone may not be enough to recover from a hosting, domain or email problem.
Add access checks to website maintenance
User access changes as the business changes, so include it in the regular maintenance routine. A quarterly check is a sensible starting point for a straightforward site, but review sooner after staff or supplier changes. The right frequency depends on how many people use the website and how sensitive its functions are.
Access is only one part of looking after WordPress. Updates, backups, forms and important visitor journeys also need attention. The guide to WordPress maintenance for small businesses sets out a broader routine.
If your website access has grown into a muddle, make an inventory before changing anything. Identify the owners, roles and integrations, confirm what each still needs, then remove access in controlled steps. For help planning a maintainable WordPress website, send Mighty Digital Studio a project enquiry.