Over the years, a lot of people can end up with access to a business website: the developer who built it, a marketing agency, a former employee, a freelancer who fixed one thing. Their accounts often stay long after they have gone. Every one of them is a door into your site.
Start with a list
In your WordPress dashboard, go to Users and filter by Administrator. For each account, ask:
- Do I know who this is?
- Do they still work with us?
- Do they need to be an administrator, or would a lower role such as Editor be enough?
An administrator account you don’t recognize is a serious warning sign. Attackers often create one with an ordinary-looking name so it blends in. Don’t just delete it: find out how it got there, because it usually means something else on the site is compromised too.
Simple rules that make a big difference
- One person, one login. Never share a single admin account between several people. Separate accounts mean you can remove one person without changing everyone’s password.
- Give the lowest role that works. Someone who writes blog posts doesn’t need to install plugins.
- Turn on two-factor authentication. A code from a phone app means a stolen password on its own isn’t enough to log in.
- Use unique passwords. A password manager makes this easy. Reused passwords from other breached sites are one of the most common ways in.
- Remove people when they leave. Make it part of ending any project or job, the same as returning a key.
Don’t forget the other logins
WordPress is only one of the doors. Your hosting account, domain registrar, FTP/SFTP and database logins matter just as much, and often more. Review who has access to those too, and turn on two-factor authentication wherever it is offered.
Our free health check includes a review of administrator accounts, so you can see exactly who has the keys.